Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Why does the erc20 oracle yield false positives? #545

Open
vilotgit opened this issue Oct 2, 2024 · 0 comments
Open

Why does the erc20 oracle yield false positives? #545

vilotgit opened this issue Oct 2, 2024 · 0 comments

Comments

@vilotgit
Copy link

vilotgit commented Oct 2, 2024

I ran the following command.
ityfuzz evm -t 0x68EB5c749a90b195F8723414d9f5E1ae273f59E1,0x55d398326f99059fF775485246999027B3197955,0x17269a3CACB6eA16FE5137eC3ccBde00A6A97668 -f -c bsc -d erc20 --onchain-etherscan-api-key <API_KEY>

And got the following result.

😊😊 Found vulnerabilities!


================ Description ================
[Fund Loss]: Anyone can earn 8.254 ETH by interacting with the provided contracts

================ Trace ================
[Sender] 0xe1A425f1AC34A8a441566f93c82dD730639c8510
   └─[1] 0x17269a3CACB6eA16FE5137eC3ccBde00A6A97668.sync()
[Sender] 0x68Dd4F5AC792eAaa5e36f4f4e0474E0625dc9024
   ├─[1] Router.swapExactETHForTokens{value: 18.4467 ether}(0, path:(WETH → 0x68EB5c749a90b195F8723414d9f5E1ae273f59E1), address(this), block.timestamp);
   └─[1] 0x68EB5c749a90b195F8723414d9f5E1ae273f59E1.transfer(0x68Dd4F5AC792eAaa5e36f4f4e0474E0625dc9024, 0)

However, when I try to reproduce the exploit with foundry forge (with enough initial funds), the transaction does not yield the promised profit. In fact, it does not yield any profit. In addition, the contracts involved do not seem to have enough tokens to yield 8.254ETH.

According to the code in src/evm/tokens/v2_transformers, it seems like ityfuzz handles liquidation by iterating through necessary Uniswap swaps. Are there any approximation steps involved with this procedure? Where is the 8.254 ETH profit coming from?

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant