uups-checker 1.0.0

package/check-sync-lp.js

@@ -0,0 +1,97 @@
+// Quick script to check SyncToken LP value
+// Run: node check-sync-lp.js
+
+const { ethers } = require('ethers');
+
+const RPC = 'https://bsc-mainnet.infura.io/v3/db4d2c885bc946b691dbb3d5ef26d9e2';
+const LP_PAIR = '0x24df7bdbc67b0eb03074ea9d8cbba0445fb35937';
+const STAKING = '0x3E13019Da3baAd134493E751704D2d4245eec7Ca';
+const SYNC_TOKEN = '0xc036A13d7a6a84677DfCCeC483EED124654B7918';
+const USDT = '0x55d398326f99059fF775485246999027B3197955';
+
+const ERC20_ABI = [
+    'function balanceOf(address) view returns (uint256)',
+    'function totalSupply() view returns (uint256)',
+    'function decimals() view returns (uint8)'
+];
+
+const PAIR_ABI = [
+    'function getReserves() view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast)',
+    'function token0() view returns (address)',
+    'function token1() view returns (address)',
+    'function totalSupply() view returns (uint256)'
+];
+
+async function main() {
+    const provider = new ethers.JsonRpcProvider(RPC);
+    
+    const lpPair = new ethers.Contract(LP_PAIR, PAIR_ABI, provider);
+    const syncToken = new ethers.Contract(SYNC_TOKEN, ERC20_ABI, provider);
+    const usdt = new ethers.Contract(USDT, ERC20_ABI, provider);
+    
+    console.log('=== SyncToken LP Analysis ===\n');
+    
+    // Get LP balance in staking
+    const lpInStaking = await lpPair.balanceOf(STAKING);
+    console.log('LP tokens in staking:', ethers.formatEther(lpInStaking));
+    
+    // Get total LP supply
+    const totalLP = await lpPair.totalSupply();
+    console.log('Total LP supply:', ethers.formatEther(totalLP));
+    
+    // Get reserves
+    const reserves = await lpPair.getReserves();
+    const token0 = await lpPair.token0();
+    const token1 = await lpPair.token1();
+    
+    let syncReserve, usdtReserve;
+    if (token0.toLowerCase() === SYNC_TOKEN.toLowerCase()) {
+        syncReserve = reserves.reserve0;
+        usdtReserve = reserves.reserve1;
+    } else {
+        syncReserve = reserves.reserve1;
+        usdtReserve = reserves.reserve0;
+    }
+    
+    console.log('\n=== LP Reserves ===');
+    console.log('SYNC tokens:', ethers.formatEther(syncReserve));
+    console.log('USDT:', ethers.formatEther(usdtReserve));
+    
+    // Calculate LP value
+    const lpPercentage = (lpInStaking * 10000n) / totalLP;
+    const usdtValue = (usdtReserve * lpInStaking) / totalLP;
+    
+    console.log('\n=== Staking Contract LP Value ===');
+    console.log('LP ownership:', (Number(lpPercentage) / 100).toFixed(2), '%');
+    console.log('USDT value:', ethers.formatEther(usdtValue), 'USDT');
+    console.log('Total value (2x USDT):', ethers.formatEther(usdtValue * 2n), 'USDT');
+    
+    // Calculate drain impact
+    console.log('\n=== Exploit Impact ===');
+    const iterations = [1, 2, 3, 5, 10];
+    for (const n of iterations) {
+        const remaining = lpInStaking * (2n ** BigInt(n)) / (3n ** BigInt(n));
+        const drained = lpInStaking - remaining;
+        const percentDrained = (drained * 100n) / lpInStaking;
+        const usdtDrained = (usdtReserve * drained) / totalLP;
+        
+        console.log(`After ${n} unstake(s):`);
+        console.log(`  - LP drained: ${ethers.formatEther(drained)} (${percentDrained}%)`);
+        console.log(`  - USDT stolen: $${ethers.formatEther(usdtDrained)}`);
+    }
+    
+    // Check if exploit is possible
+    console.log('\n=== Exploit Feasibility ===');
+    const stakingBalance = await syncToken.balanceOf(STAKING);
+    console.log('SYNC in staking:', ethers.formatEther(stakingBalance));
+    
+    if (lpInStaking > 0n) {
+        console.log('✅ EXPLOIT IS POSSIBLE - LP tokens in staking contract');
+        console.log('⚠️  Attack cost: ~$150 (stake + gas)');
+        console.log('💰 Potential profit: $' + ethers.formatEther(usdtValue * 2n));
+    } else {
+        console.log('❌ No LP in staking - exploit not currently possible');
+    }
+}
+
+main().catch(console.error);

package/check-sync-stake.js

@@ -0,0 +1,42 @@
+const { ethers } = require('ethers');
+
+const RPC = 'https://bsc-dataseed.binance.org';
+const STAKING = '0x3E13019dA3BAAd134493e751704D2D4245Eec7CA';
+
+// Real stake transaction hash from the logs
+const STAKE_TX = '0xa402c631879193913Df099C50a774E09f9A372ec'; // This was the user who staked
+
+async function main() {
+    const provider = new ethers.providers.JsonRpcProvider(RPC);
+    
+    console.log('=== Checking Staking Contract ===');
+    console.log('Staking:', STAKING);
+    
+    // Get contract code
+    const code = await provider.getCode(STAKING);
+    console.log('Code exists:', code !== '0x');
+    console.log('Code length:', code.length);
+    
+    // Try to get recent stake transactions
+    console.log('\n=== Getting Recent Transactions ===');
+    const latestBlock = await provider.getBlockNumber();
+    console.log('Latest block:', latestBlock);
+    
+    // Get transactions to staking contract
+    const filter = {
+        address: STAKING,
+        fromBlock: latestBlock - 1000,
+        toBlock: 'latest'
+    };
+    
+    const logs = await provider.getLogs(filter);
+    console.log('Recent logs:', logs.length);
+    
+    if (logs.length > 0) {
+        console.log('\nFirst log:');
+        console.log('Topics:', logs[0].topics);
+        console.log('Data:', logs[0].data);
+    }
+}
+
+main().catch(console.error);

package/check-tlm.js

@@ -0,0 +1,37 @@
+const { ethers } = require('ethers');
+const fs = require('fs');
+
+const RPC = 'https://bsc-dataseed1.binance.org';
+const provider = new ethers.providers.JsonRpcProvider(RPC);
+
+const address = '0x2222227e22102fe3322098e4cbfe18cfebd57c95';
+
+async function main() {
+  const code = await provider.getCode(address);
+  console.log('Contract exists:', code !== '0x');
+  console.log('Code length:', code.length);
+  
+  // Try to get some basic info
+  const contract = new ethers.Contract(address, [
+    'function name() view returns (string)',
+    'function symbol() view returns (string)',
+    'function totalSupply() view returns (uint256)',
+    'function decimals() view returns (uint8)'
+  ], provider);
+  
+  try {
+    const name = await contract.name();
+    const symbol = await contract.symbol();
+    const supply = await contract.totalSupply();
+    const decimals = await contract.decimals();
+    
+    console.log('Name:', name);
+    console.log('Symbol:', symbol);
+    console.log('Supply:', ethers.formatUnits(supply, decimals));
+    console.log('Decimals:', decimals);
+  } catch (e) {
+    console.log('Error reading contract:', e.message);
+  }
+}
+
+main();

package/check-token-pools.js

@@ -0,0 +1,146 @@
+/**
+ * Check PancakeSwap pool liquidity for tokens vulnerable to BCE-style attacks
+ * 
+ * Tokens to check:
+ * - TITANO: 0xBA96731324dE188ebC1eD87ca74544dDEbC07D7f
+ * - RISE: (need address)
+ * - POSI: 0x5ca42204cdaa70d5c773946e69de942b85ca6706
+ * - TSC: (need address)
+ * - CATE: 0xe4fae3faa8300810c835970b9187c268f55d998f
+ */
+
+const { ethers } = require('ethers');
+
+// BSC RPC
+const provider = new ethers.JsonRpcProvider('https://bsc-dataseed.binance.org/');
+
+// Addresses
+const PANCAKE_FACTORY = '0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73';
+const WBNB = '0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c';
+const USDT = '0x55d398326f99059fF775485246999027B3197955';
+const BUSD = '0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56';
+
+const tokens = {
+    'TITANO': '0xBA96731324dE188ebC1eD87ca74544dDEbC07D7f',
+    'POSI': '0x5ca42204cdaa70d5c773946e69de942b85ca6706',
+    'CATE': '0xe4fae3faa8300810c835970b9187c268f55d998f',
+    // 'RISE': '', // Need address
+    // 'TSC': '',  // Need address
+};
+
+const factoryAbi = [
+    'function getPair(address tokenA, address tokenB) external view returns (address pair)'
+];
+
+const pairAbi = [
+    'function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast)',
+    'function token0() external view returns (address)',
+    'function token1() external view returns (address)',
+    'function totalSupply() external view returns (uint256)'
+];
+
+const erc20Abi = [
+    'function decimals() external view returns (uint8)',
+    'function symbol() external view returns (string)'
+];
+
+async function getPairInfo(factory, tokenA, tokenB, quoteSymbol) {
+    try {
+        const pairAddress = await factory.getPair(tokenA, tokenB);
+        
+        if (pairAddress === ethers.ZeroAddress) {
+            return null;
+        }
+        
+        const pair = new ethers.Contract(pairAddress, pairAbi, provider);
+        const [reserve0, reserve1] = await pair.getReserves();
+        const token0 = await pair.token0();
+        const token1 = await pair.token1();
+        
+        // Determine which reserve is the quote token
+        const quoteReserve = token0.toLowerCase() === tokenB.toLowerCase() ? reserve0 : reserve1;
+        const tokenReserve = token0.toLowerCase() === tokenB.toLowerCase() ? reserve1 : reserve0;
+        
+        // Get decimals
+        const quoteToken = new ethers.Contract(tokenB, erc20Abi, provider);
+        const decimals = await quoteToken.decimals();
+        
+        const liquidity = Number(quoteReserve) / (10 ** Number(decimals));
+        
+        return {
+            pair: pairAddress,
+            liquidity,
+            quoteSymbol,
+            reserve0: reserve0.toString(),
+            reserve1: reserve1.toString(),
+            tokenReserve: tokenReserve.toString()
+        };
+    } catch (error) {
+        return null;
+    }
+}
+
+async function checkToken(name, address) {
+    console.log(`\n=== ${name} (${address}) ===`);
+    
+    const factory = new ethers.Contract(PANCAKE_FACTORY, factoryAbi, provider);
+    
+    // Check USDT pair
+    const usdtPair = await getPairInfo(factory, address, USDT, 'USDT');
+    if (usdtPair) {
+        console.log(`USDT Pair: ${usdtPair.pair}`);
+        console.log(`Liquidity: $${usdtPair.liquidity.toLocaleString()}`);
+        
+        if (usdtPair.liquidity < 10000) {
+            console.log('⚠️  CRITICAL: <$10k liquidity - HIGHLY VULNERABLE to BCE attack');
+        } else if (usdtPair.liquidity < 50000) {
+            console.log('⚠️  WARNING: <$50k liquidity - VULNERABLE to BCE attack');
+        } else if (usdtPair.liquidity < 100000) {
+            console.log('⚠️  CAUTION: <$100k liquidity - RISKY');
+        } else {
+            console.log('✓ Safer: >$100k liquidity');
+        }
+    }
+    
+    // Check WBNB pair
+    const wbnbPair = await getPairInfo(factory, address, WBNB, 'WBNB');
+    if (wbnbPair) {
+        console.log(`\nWBNB Pair: ${wbnbPair.pair}`);
+        console.log(`Liquidity: ${wbnbPair.liquidity.toLocaleString()} WBNB (~$${(wbnbPair.liquidity * 600).toLocaleString()})`);
+        
+        const usdValue = wbnbPair.liquidity * 600; // Approximate BNB price
+        if (usdValue < 10000) {
+            console.log('⚠️  CRITICAL: <$10k liquidity - HIGHLY VULNERABLE');
+        } else if (usdValue < 50000) {
+            console.log('⚠️  WARNING: <$50k liquidity - VULNERABLE');
+        }
+    }
+    
+    // Check BUSD pair
+    const busdPair = await getPairInfo(factory, address, BUSD, 'BUSD');
+    if (busdPair) {
+        console.log(`\nBUSD Pair: ${busdPair.pair}`);
+        console.log(`Liquidity: $${busdPair.liquidity.toLocaleString()}`);
+    }
+    
+    if (!usdtPair && !wbnbPair && !busdPair) {
+        console.log('❌ No PancakeSwap pairs found');
+    }
+}
+
+async function main() {
+    console.log('=== BCE ATTACK PATTERN VULNERABILITY CHECK ===');
+    console.log('Checking PancakeSwap pool liquidity for 5 tokens...\n');
+    console.log('BCE was exploited with $114k borrowed capital vs ~$17k pool liquidity');
+    console.log('Attack: Flashloan -> Venus borrow -> Pump/dump low-liquidity pool\n');
+    
+    for (const [name, address] of Object.entries(tokens)) {
+        await checkToken(name, address);
+    }
+    
+    console.log('\n=== SUMMARY ===');
+    console.log('Tokens with <$50k liquidity are vulnerable to the same attack pattern as BCE');
+    console.log('Attack requires: Flashloan provider + Venus Protocol leverage + Low liquidity DEX pool');
+}
+
+main().catch(console.error);

package/check-trunk-depeg.js

@@ -0,0 +1,181 @@
+const { ethers } = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://bsc-dataseed.binance.org/');
+
+const TRUNK = '0xdd325C38b12903B727D16961e61333f4871A70E0';
+const BUSD = '0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56';
+const WBNB = '0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c';
+const PANCAKE_FACTORY = '0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73';
+
+const FACTORY_ABI = [
+    'function getPair(address tokenA, address tokenB) external view returns (address pair)'
+];
+
+const PAIR_ABI = [
+    'function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast)',
+    'function token0() external view returns (address)',
+    'function token1() external view returns (address)',
+    'function totalSupply() external view returns (uint256)'
+];
+
+const ERC20_ABI = [
+    'function totalSupply() external view returns (uint256)',
+    'function balanceOf(address) external view returns (uint256)',
+    'function decimals() external view returns (uint8)',
+    'function symbol() external view returns (string)'
+];
+
+const TRUNK_ABI = [
+    'function burn(uint256 amount) external',
+    'function targetSupply() external view returns (uint256)'
+];
+
+async function analyzeTrunkDepeg() {
+    console.log('=== TRUNK DEPEG ATTACK ANALYSIS ===\n');
+    
+    const trunk = new ethers.Contract(TRUNK, [...ERC20_ABI, ...TRUNK_ABI], provider);
+    const factory = new ethers.Contract(PANCAKE_FACTORY, FACTORY_ABI, provider);
+    
+    // Get TRUNK info
+    const totalSupply = await trunk.totalSupply();
+    const targetSupply = await trunk.targetSupply();
+    
+    console.log('TRUNK TOKEN INFO:');
+    console.log('- Total Supply:', ethers.utils.formatEther(totalSupply), 'TRUNK');
+    console.log('- Target Supply:', ethers.utils.formatUnits(targetSupply, 0));
+    console.log('- Claimed Backing: 75% BUSD + 25% ELEPHANT');
+    console.log('- Redemption: NONE (no redeem function)');
+    
+    // Check for TRUNK pools
+    console.log('\nTRUNK LIQUIDITY POOLS:\n');
+    
+    const pools = [
+        { name: 'TRUNK/BUSD', token0: TRUNK, token1: BUSD },
+        { name: 'TRUNK/WBNB', token0: TRUNK, token1: WBNB }
+    ];
+    
+    let totalLiquidity = ethers.BigNumber.from(0);
+    let trunkInPools = ethers.BigNumber.from(0);
+    
+    for (const poolInfo of pools) {
+        try {
+            const pairAddress = await factory.getPair(poolInfo.token0, poolInfo.token1);
+            
+            if (pairAddress === ethers.constants.AddressZero) {
+                console.log(`${poolInfo.name}: NO POOL`);
+                continue;
+            }
+            
+            const pair = new ethers.Contract(pairAddress, PAIR_ABI, provider);
+            const reserves = await pair.getReserves();
+            const token0 = await pair.token0();
+            const lpTotalSupply = await pair.totalSupply();
+            
+            const isTrunkToken0 = token0.toLowerCase() === TRUNK.toLowerCase();
+            const trunkReserve = isTrunkToken0 ? reserves.reserve0 : reserves.reserve1;
+            const otherReserve = isTrunkToken0 ? reserves.reserve1 : reserves.reserve0;
+            
+            console.log(`${poolInfo.name}: POOL EXISTS`);
+            console.log(`  Address: ${pairAddress}`);
+            console.log(`  TRUNK Reserve: ${ethers.utils.formatEther(trunkReserve)}`);
+            console.log(`  Other Reserve: ${ethers.utils.formatEther(otherReserve)}`);
+            console.log(`  LP Supply: ${ethers.utils.formatEther(lpTotalSupply)}`);
+            
+            if (trunkReserve.gt(0) && otherReserve.gt(0)) {
+                // Calculate price
+                const price = otherReserve.mul(ethers.utils.parseEther('1')).div(trunkReserve);
+                console.log(`  Price: 1 TRUNK = ${ethers.utils.formatEther(price)} ${poolInfo.token1 === BUSD ? 'BUSD' : 'WBNB'}`);
+                
+                // Check peg
+                if (poolInfo.token1 === BUSD) {
+                    const pegDeviation = price.sub(ethers.utils.parseEther('1')).mul(100).div(ethers.utils.parseEther('1'));
+                    console.log(`  Peg Deviation: ${ethers.utils.formatUnits(pegDeviation.abs(), 0)}%`);
+                    
+                    if (price.lt(ethers.utils.parseEther('0.95'))) {
+                        console.log('  Status: DEPEGGED BELOW $0.95 ⚠️');
+                    } else if (price.gt(ethers.utils.parseEther('1.05'))) {
+                        console.log('  Status: DEPEGGED ABOVE $1.05 ⚠️');
+                    } else {
+                        console.log('  Status: PEGGED ✓');
+                    }
+                }
+                
+                trunkInPools = trunkInPools.add(trunkReserve);
+                
+                // Estimate liquidity in USD
+                if (poolInfo.token1 === BUSD) {
+                    totalLiquidity = totalLiquidity.add(otherReserve.mul(2));
+                }
+            } else {
+                console.log('  Status: NO LIQUIDITY');
+            }
+            
+        } catch (error) {
+            console.log(`${poolInfo.name}: ERROR - ${error.message}`);
+        }
+        console.log('');
+    }
+    
+    console.log('LIQUIDITY SUMMARY:');
+    console.log('- Total TRUNK in pools:', ethers.utils.formatEther(trunkInPools));
+    console.log('- % of supply in pools:', trunkInPools.mul(100).div(totalSupply).toString() + '%');
+    console.log('- Total liquidity (USD):', ethers.utils.formatEther(totalLiquidity));
+    
+    // Check top holders
+    console.log('\n=== DEPEG ATTACK VECTORS ===\n');
+    
+    console.log('1. PUBLIC BURN ATTACK:');
+    console.log('   - burn() function is PUBLIC');
+    console.log('   - Anyone can burn their TRUNK');
+    console.log('   - Reduces supply → increases scarcity');
+    console.log('   - But: Need to own TRUNK first (costs money)');
+    console.log('   - Impact: Minimal unless burning large amounts');
+    
+    console.log('\n2. LIQUIDITY DRAIN:');
+    console.log('   - Buy all TRUNK from pools');
+    console.log('   - Removes liquidity');
+    console.log('   - Price spikes up');
+    console.log('   - But: Expensive and you end up holding TRUNK');
+    
+    console.log('\n3. DUMP ATTACK:');
+    console.log('   - Need large TRUNK holdings');
+    console.log('   - Sell all at once');
+    console.log('   - Price crashes');
+    console.log('   - But: Need to acquire TRUNK first');
+    
+    console.log('\n4. NO REDEMPTION EXPLOIT:');
+    console.log('   - TRUNK has NO redeem() function');
+    console.log('   - Cannot exchange for collateral');
+    console.log('   - If peg breaks, no arbitrage mechanism');
+    console.log('   - This is the KEY vulnerability!');
+    
+    console.log('\n=== PROFITABLE DEPEG STRATEGY ===\n');
+    
+    console.log('STEP 1: SHORT TRUNK');
+    console.log('- Borrow TRUNK from holders (if possible)');
+    console.log('- Or buy TRUNK and prepare to sell');
+    
+    console.log('\nSTEP 2: TRIGGER DEPEG');
+    console.log('- Sell large amount of TRUNK');
+    console.log('- Price drops below $1');
+    console.log('- No redemption mechanism to restore peg');
+    
+    console.log('\nSTEP 3: PROFIT');
+    console.log('- If you shorted: profit from price drop');
+    console.log('- If you bought cheap: wait for recovery (risky)');
+    
+    console.log('\nPROBLEM:');
+    console.log('- Need initial TRUNK to dump');
+    console.log('- Buying TRUNK costs money');
+    console.log('- No way to short without borrowing');
+    console.log('- Limited liquidity makes attack expensive');
+    
+    console.log('\n=== REALITY CHECK ===');
+    console.log('Liquidity:', ethers.utils.formatEther(totalLiquidity), 'USD');
+    console.log('To depeg 10%: Need to sell ~', ethers.utils.formatEther(totalLiquidity.div(10)), 'USD worth');
+    console.log('Cost: HIGH');
+    console.log('Profit: UNCERTAIN (depends on short position)');
+    console.log('Risk: HIGH (could lose money)');
+}
+
+analyzeTrunkDepeg().catch(console.error);

package/check-tusd-decimals.js

@@ -0,0 +1,58 @@
+const { ethers } = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://bsc-dataseed.binance.org/');
+const tusd = '0x14016E85a25aeb13065688cAFB43044C2ef86784';
+
+async function main() {
+    console.log('=== TUSD DECIMAL/UNDERFLOW ANALYSIS ===\n');
+    
+    const decimals = await provider.call({
+        to: tusd,
+        data: '0x313ce567' // decimals()
+    });
+    console.log('Decimals:', parseInt(decimals, 16));
+    
+    const totalSupply = await provider.call({
+        to: tusd,
+        data: '0x18160ddd' // totalSupply()
+    });
+    console.log('Total Supply:', BigInt(totalSupply).toString());
+    
+    const contractBalance = await provider.call({
+        to: tusd,
+        data: '0x70a08231' + tusd.slice(2).padStart(64, '0') // balanceOf(contract)
+    });
+    console.log('Contract Balance:', BigInt(contractBalance).toString());
+    console.log('Trapped USD:', (Number(BigInt(contractBalance)) / 1e18).toFixed(2));
+    
+    // Check if there's a way to call arbitrary functions
+    const selectors = [
+        '0x1cff79cd', // execute(address,bytes)
+        '0xb61d27f6', // execute(address,uint256,bytes)
+        '0x6a761202', // executeTransaction(address,uint256,string,bytes)
+    ];
+    
+    console.log('\n=== CHECKING FOR ADMIN EXECUTE FUNCTIONS ===');
+    for (const sel of selectors) {
+        try {
+            await provider.call({
+                to: tusd,
+                data: sel + '0'.repeat(128)
+            });
+            console.log('Found function:', sel);
+        } catch (e) {
+            // Expected to revert
+        }
+    }
+    
+    console.log('\n=== CONCLUSION ===');
+    console.log('The $15K TUSD is trapped because:');
+    console.log('1. Contract CAN transfer its own balance');
+    console.log('2. But you need to execute AS the contract (msg.sender = contract)');
+    console.log('3. No delegatecall in implementation');
+    console.log('4. No admin execute functions found');
+    console.log('5. Not ERC777 (no hooks for reentrancy)');
+    console.log('\nVERDICT: Funds are PERMANENTLY TRAPPED unless admin upgrades');
+}
+
+main().catch(console.error);

package/check-user-storage-deep.js

@@ -0,0 +1,81 @@
+const { ethers } = require('ethers');
+
+const RPC = 'https://bsc-dataseed.binance.org';
+const provider = new ethers.providers.JsonRpcProvider(RPC);
+
+const STAKING = '0x107E5696fAc55207DFC05C071404C31CEc57d47A';
+const REAL_USER = '0xc75124Cc9d40d7f53FB05B5f8CC13638EfD869fE';
+const FUND_ID = 5768;
+
+async function checkUserStorage() {
+    console.log('=== DEEP STORAGE ANALYSIS ===\n');
+    
+    // Check mapping slot 11 (where we found the stake)
+    const slot11 = ethers.utils.keccak256(
+        ethers.utils.defaultAbiCoder.encode(['address', 'uint256'], [REAL_USER, 11])
+    );
+    
+    console.log('User stake slot:', slot11);
+    const stakeValue = await provider.getStorageAt(STAKING, slot11);
+    console.log('Stake value:', BigInt(stakeValue).toString());
+    console.log('Stake in FARA:', ethers.utils.formatEther(BigInt(stakeValue)));
+    
+    // Check adjacent slots (might be a struct)
+    console.log('\n=== CHECKING ADJACENT SLOTS (STRUCT DATA) ===');
+    for (let offset = 0; offset < 10; offset++) {
+        const adjacentSlot = BigInt(slot11) + BigInt(offset);
+        const value = await provider.getStorageAt(STAKING, '0x' + adjacentSlot.toString(16));
+        
+        if (value !== '0x0000000000000000000000000000000000000000000000000000000000000000') {
+            console.log(`\nSlot +${offset}:`, value);
+            const asNumber = BigInt(value);
+            console.log('  As uint256:', asNumber.toString());
+            
+            // Check if it's a timestamp
+            if (asNumber > 1000000000n && asNumber < 10000000000n) {
+                const date = new Date(Number(asNumber) * 1000);
+                console.log('  As timestamp:', date.toISOString());
+            }
+            
+            // Check if it's a FARA amount
+            if (asNumber > 1e18) {
+                console.log('  As FARA:', ethers.utils.formatEther(asNumber));
+            }
+        }
+    }
+    
+    // Check if there's a nested mapping: mapping(address => mapping(uint256 => Stake))
+    console.log('\n=== CHECKING NESTED MAPPING (USER => FUNDID) ===');
+    
+    // First hash: keccak256(fundId, keccak256(user, mapSlot))
+    for (let mapSlot = 10; mapSlot < 15; mapSlot++) {
+        const userSlot = ethers.utils.keccak256(
+            ethers.utils.defaultAbiCoder.encode(['address', 'uint256'], [REAL_USER, mapSlot])
+        );
+        
+        const fundSlot = ethers.utils.keccak256(
+            ethers.utils.defaultAbiCoder.encode(['uint256', 'bytes32'], [FUND_ID, userSlot])
+        );
+        
+        const value = await provider.getStorageAt(STAKING, fundSlot);
+        
+        if (value !== '0x0000000000000000000000000000000000000000000000000000000000000000') {
+            console.log(`\nFound data in nested mapping slot ${mapSlot}:`);
+            console.log('  Slot:', fundSlot);
+            console.log('  Value:', value);
+            console.log('  As uint256:', BigInt(value).toString());
+            
+            // Check adjacent slots in the struct
+            for (let offset = 0; offset < 5; offset++) {
+                const adjacentSlot = BigInt(fundSlot) + BigInt(offset);
+                const adjValue = await provider.getStorageAt(STAKING, '0x' + adjacentSlot.toString(16));
+                
+                if (adjValue !== '0x0000000000000000000000000000000000000000000000000000000000000000') {
+                    console.log(`  +${offset}:`, adjValue, '=', BigInt(adjValue).toString());
+                }
+            }
+        }
+    }
+}
+
+checkUserStorage().catch(console.error);