// SPDX-License-Identifier: MIT
pragma solidity 0.8.9;

interface IPool {
    function getPoolState() external view returns (uint160 sqrtP, int24 currentTick, int24 nearestCurrentTick, bool locked);
    function getLiquidityState() external view returns (uint128 baseL, uint128 reinvestL, uint128 reinvestLLast);
    function token0() external view returns (address);
    function token1() external view returns (address);
    function swapFeeUnits() external view returns (uint24);
    function tickDistance() external view returns (int24);
}

interface IERC20 {
    function balanceOf(address) external view returns (uint256);
}

contract CheckKyberExploit {
    
    struct PoolVulnerabilityCheck {
        bool isVulnerable;
        
        // Pool state
        uint128 baseL;
        uint128 reinvestL;
        uint128 reinvestLLast;
        int24 currentTick;
        int24 nearestCurrentTick;
        uint160 sqrtP;
        uint24 swapFeeUnits;
        int24 tickDistance;
        
        // Token info
        address token0;
        address token1;
        uint256 token0Balance;
        uint256 token1Balance;
        
        // Vulnerability conditions
        bool hasReinvestmentLiquidity;
        bool hasSufficientReinvestL;
        bool hasLiquidity;
        bool hasTokens;
        uint256 reinvestLRatio; // reinvestL as % of total pool value (basis points)
        uint256 atRisk;
    }
    
    /**
     * @notice Check if a Kyber Elastic pool is vulnerable to the liquidity duplication exploit
     * @param poolAddress The Kyber Elastic pool to check
     * @return isVulnerable True if pool is exploitable (reinvestL > 0 AND has drainable tokens)
     * @return atRisk Total pool token balance at risk (token0 + token1)
     * 
     * ROOT CAUSE:
     * calcReachAmount() uses (baseL + reinvestL) to compute swap quantity needed to reach tick 
     * boundary. Inflated liquidity causes nextSqrtP to overshoot boundary, preventing 
     * _updateLiquidityAndCrossTick() from executing. On reverse swap, liquidity is counted 
     * twice (once as residual, once when crossing), doubling effective depth and enabling 
     * extraction of excess tokens from the entire pool.
     * 
     * ATTACK PATTERN:
     * 1. Manipulate price to isolated tick range where attacker is sole LP
     * 2. Tune baseL in that range to precise amount via partial liquidity removal
     * 3. Forward swap with exact amount to overshoot boundary (skip liquidity update)
     * 4. Reverse swap at doubled liquidity to extract profit
     * 5. Repeat until pool exhausted or unprofitable
     * 
     * VULNERABILITY CONDITION:
     * Pool is exploitable if reinvestL > 0 (any non-zero value) AND pool holds drainable tokens.
     * No minimum threshold exists - attacker controls baseL via LP manipulation to reach 
     * exploitable state
     */
    function checkKyberExploit(address poolAddress) external view returns (bool, uint256) {
        PoolVulnerabilityCheck memory result = _getKyberPoolState(poolAddress);
        return (result.isVulnerable, result.atRisk);
    }

    function _getKyberPoolState(address poolAddress) internal view returns (PoolVulnerabilityCheck memory result) {
        IPool pool = IPool(poolAddress);
        
        // Fetch pool state
        (result.sqrtP, result.currentTick, result.nearestCurrentTick, ) = pool.getPoolState();
        (result.baseL, result.reinvestL, result.reinvestLLast) = pool.getLiquidityState();
        result.swapFeeUnits = pool.swapFeeUnits();
        result.tickDistance = pool.tickDistance();
        result.token0 = pool.token0();
        result.token1 = pool.token1();
        result.token0Balance = IERC20(result.token0).balanceOf(poolAddress);
        result.token1Balance = IERC20(result.token1).balanceOf(poolAddress);
        
        // Vulnerability conditions
        result.hasReinvestmentLiquidity = (result.reinvestL > 0);
        result.hasTokens = (result.token0Balance > 0 && result.token1Balance > 0);
        result.hasLiquidity = (result.baseL > 0 || result.reinvestL > 0);
        result.hasSufficientReinvestL = (result.reinvestL >= 1e15);
        
        uint256 totalLiquidity = uint256(result.baseL) + uint256(result.reinvestL);
        result.reinvestLRatio = (totalLiquidity > 0 && result.reinvestL > 0) 
            ? (uint256(result.reinvestL) * 10000) / totalLiquidity 
            : 0;
        
        result.isVulnerable = result.hasReinvestmentLiquidity && result.hasTokens;

        // At-risk calculation: Exploit allows extraction via liquidity duplication in narrow tick ranges.
        // Attacker profits by swapping at inflated effective liquidity, draining from entire pool.
        // Real-world Nov 2023 attack: $54.7M total across multiple pools/chains via repeated cycles.
        // Per-cycle profit depends on: baseL tuning, reinvestL magnitude, pool imbalance, gas costs.
        // 
        // Conservative estimate: Total pool liquidity at risk. Actual drainage is iterative and
        // typically exhausts pool over multiple attack transactions until reinvestL depletes or
        // becomes unprofitable.
        result.atRisk = result.token0Balance + result.token1Balance;
        
        return result;
    }
}

{
  "remappings": [
    "ds-test/=lib/forge-std/lib/ds-test/src/",
    "erc4626-tests/=lib/openzeppelin-contracts/lib/erc4626-tests/",
    "forge-std/=lib/forge-std/src/",
    "openzeppelin-contracts/=lib/openzeppelin-contracts/contracts/",
    "@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/",
    "@openzeppelin/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts/",
    "openzeppelin-contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts/"
  ],
  "optimizer": {
    "enabled": true,
    "runs": 500
  },
  "metadata": {
    "useLiteralContent": false,
    "bytecodeHash": "ipfs"
  },
  "outputSelection": {
    "*": {
      "*": [
        "evm.bytecode",
        "evm.deployedBytecode",
        "devdoc",
        "userdoc",
        "metadata",
        "abi"
      ]
    }
  },
  "evmVersion": "london",
  "viaIR": false
}

[{"inputs":[{"internalType":"address","name":"poolAddress","type":"address"}],"name":"checkKyberExploit","outputs":[{"internalType":"bool","name":"","type":"bool"},{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"}]

0x608060405234801561001057600080fd5b506108b5806100206000396000f3fe608060405234801561001057600080fd5b506004361061002b5760003560e01c8063a848d89514610030575b600080fd5b61004361003e3660046106a8565b61005e565b60408051921515835260208301919091520160405180910390f35b600080600061006c84610080565b805161024090910151909590945092505050565b6040805161026081018252600080825260208201819052918101829052606081018290526080810182905260a0810182905260c0810182905260e08101829052610100810182905261012081018290526101408101829052610160810182905261018081018290526101a081018290526101c081018290526101e08101829052610200810182905261022081018290526102408101919091526000829050806001600160a01b031663217ac2376040518163ffffffff1660e01b815260040160806040518083038186803b15801561015757600080fd5b505afa15801561016b573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061018f91906106e3565b50600290810b60a08601520b60808401526001600160a01b0390811660c08401526040805163ab612f2b60e01b815290519183169163ab612f2b91600480820192606092909190829003018186803b1580156101ea57600080fd5b505afa1580156101fe573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906102229190610757565b6001600160801b039081166060860152908116604080860191909152911660208085019190915281516363cd2c8760e11b815291516001600160a01b0384169263c79a590e926004808301939192829003018186803b15801561028457600080fd5b505afa158015610298573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906102bc919061079a565b62ffffff1660e0830152604080516312189aa360e21b815290516001600160a01b038316916348626a8c916004808301926020929190829003018186803b15801561030657600080fd5b505afa15801561031a573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061033e91906107bf565b60020b61010083015260408051630dfe168160e01b815290516001600160a01b03831691630dfe1681916004808301926020929190829003018186803b15801561038757600080fd5b505afa15801561039b573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906103bf91906107da565b8261012001906001600160a01b031690816001600160a01b031681525050806001600160a01b031663d21220a76040518163ffffffff1660e01b815260040160206040518083038186803b15801561041657600080fd5b505afa15801561042a573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061044e91906107da565b6001600160a01b039081166101408401526101208301516040516370a0823160e01b815285831660048201529116906370a082319060240160206040518083038186803b15801561049e57600080fd5b505afa1580156104b2573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906104d691906107f7565b6101608301526101408201516040516370a0823160e01b81526001600160a01b038581166004830152909116906370a082319060240160206040518083038186803b15801561052457600080fd5b505afa158015610538573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061055c91906107f7565b61018083015260408201516001600160801b031615156101a08301526101608201511580159061059157506000826101800151115b151561020083015260208201516001600160801b03161515806105c15750600082604001516001600160801b0316115b15156101e0830152604082015166038d7ea4c680006001600160801b03918216908110156101c085015260208401516000926105fe929116610826565b905060008111801561061d5750600083604001516001600160801b0316115b61062857600061064e565b8083604001516001600160801b0316612710610644919061083e565b61064e919061085d565b6102208401526101a0830151801561066857508261020001515b151583526101808301516101608401516106829190610826565b610240840152509092915050565b6001600160a01b03811681146106a557600080fd5b50565b6000602082840312156106ba57600080fd5b81356106c581610690565b9392505050565b8051600281900b81146106de57600080fd5b919050565b600080600080608085870312156106f957600080fd5b845161070481610690565b9350610712602086016106cc565b9250610720604086016106cc565b91506060850151801515811461073557600080fd5b939692955090935050565b80516001600160801b03811681146106de57600080fd5b60008060006060848603121561076c57600080fd5b61077584610740565b925061078360208501610740565b915061079160408501610740565b90509250925092565b6000602082840312156107ac57600080fd5b815162ffffff811681146106c557600080fd5b6000602082840312156107d157600080fd5b6106c5826106cc565b6000602082840312156107ec57600080fd5b81516106c581610690565b60006020828403121561080957600080fd5b5051919050565b634e487b7160e01b600052601160045260246000fd5b6000821982111561083957610839610810565b500190565b600081600019048311821515161561085857610858610810565b500290565b60008261087a57634e487b7160e01b600052601260045260246000fd5b50049056fea2646970667358221220cd861ca66ad45121241af7420e9283ff4b870da828211201c33ea9a21732f63764736f6c63430008090033

0x608060405234801561001057600080fd5b506004361061002b5760003560e01c8063a848d89514610030575b600080fd5b61004361003e3660046106a8565b61005e565b60408051921515835260208301919091520160405180910390f35b600080600061006c84610080565b805161024090910151909590945092505050565b6040805161026081018252600080825260208201819052918101829052606081018290526080810182905260a0810182905260c0810182905260e08101829052610100810182905261012081018290526101408101829052610160810182905261018081018290526101a081018290526101c081018290526101e08101829052610200810182905261022081018290526102408101919091526000829050806001600160a01b031663217ac2376040518163ffffffff1660e01b815260040160806040518083038186803b15801561015757600080fd5b505afa15801561016b573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061018f91906106e3565b50600290810b60a08601520b60808401526001600160a01b0390811660c08401526040805163ab612f2b60e01b815290519183169163ab612f2b91600480820192606092909190829003018186803b1580156101ea57600080fd5b505afa1580156101fe573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906102229190610757565b6001600160801b039081166060860152908116604080860191909152911660208085019190915281516363cd2c8760e11b815291516001600160a01b0384169263c79a590e926004808301939192829003018186803b15801561028457600080fd5b505afa158015610298573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906102bc919061079a565b62ffffff1660e0830152604080516312189aa360e21b815290516001600160a01b038316916348626a8c916004808301926020929190829003018186803b15801561030657600080fd5b505afa15801561031a573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061033e91906107bf565b60020b61010083015260408051630dfe168160e01b815290516001600160a01b03831691630dfe1681916004808301926020929190829003018186803b15801561038757600080fd5b505afa15801561039b573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906103bf91906107da565b8261012001906001600160a01b031690816001600160a01b031681525050806001600160a01b031663d21220a76040518163ffffffff1660e01b815260040160206040518083038186803b15801561041657600080fd5b505afa15801561042a573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061044e91906107da565b6001600160a01b039081166101408401526101208301516040516370a0823160e01b815285831660048201529116906370a082319060240160206040518083038186803b15801561049e57600080fd5b505afa1580156104b2573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906104d691906107f7565b6101608301526101408201516040516370a0823160e01b81526001600160a01b038581166004830152909116906370a082319060240160206040518083038186803b15801561052457600080fd5b505afa158015610538573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061055c91906107f7565b61018083015260408201516001600160801b031615156101a08301526101608201511580159061059157506000826101800151115b151561020083015260208201516001600160801b03161515806105c15750600082604001516001600160801b0316115b15156101e0830152604082015166038d7ea4c680006001600160801b03918216908110156101c085015260208401516000926105fe929116610826565b905060008111801561061d5750600083604001516001600160801b0316115b61062857600061064e565b8083604001516001600160801b0316612710610644919061083e565b61064e919061085d565b6102208401526101a0830151801561066857508261020001515b151583526101808301516101608401516106829190610826565b610240840152509092915050565b6001600160a01b03811681146106a557600080fd5b50565b6000602082840312156106ba57600080fd5b81356106c581610690565b9392505050565b8051600281900b81146106de57600080fd5b919050565b600080600080608085870312156106f957600080fd5b845161070481610690565b9350610712602086016106cc565b9250610720604086016106cc565b91506060850151801515811461073557600080fd5b939692955090935050565b80516001600160801b03811681146106de57600080fd5b60008060006060848603121561076c57600080fd5b61077584610740565b925061078360208501610740565b915061079160408501610740565b90509250925092565b6000602082840312156107ac57600080fd5b815162ffffff811681146106c557600080fd5b6000602082840312156107d157600080fd5b6106c5826106cc565b6000602082840312156107ec57600080fd5b81516106c581610690565b60006020828403121561080957600080fd5b5051919050565b634e487b7160e01b600052601160045260246000fd5b6000821982111561083957610839610810565b500190565b600081600019048311821515161561085857610858610810565b500290565b60008261087a57634e487b7160e01b600052601260045260246000fd5b50049056fea2646970667358221220cd861ca66ad45121241af7420e9283ff4b870da828211201c33ea9a21732f63764736f6c63430008090033