uups-checker 1.0.0

package/check-welephant-pools.js

@@ -0,0 +1,130 @@
+const { ethers } = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://bsc-dataseed.binance.org/');
+
+const WELEPHANT = '0xA546d072BF7656D10bFedACD4B93a5358C4D8E47';
+const ELEPHANT = '0xE283D0e3B8c102BAdF5E8166B73E02D96d92F688';
+const WBNB = '0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c';
+const PANCAKE_FACTORY = '0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73';
+
+const FACTORY_ABI = [
+    'function getPair(address tokenA, address tokenB) external view returns (address pair)'
+];
+
+const PAIR_ABI = [
+    'function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast)',
+    'function token0() external view returns (address)',
+    'function token1() external view returns (address)'
+];
+
+const ERC20_ABI = [
+    'function decimals() external view returns (uint8)',
+    'function symbol() external view returns (string)',
+    'function balanceOf(address) external view returns (uint256)'
+];
+
+async function checkWElephantPools() {
+    console.log('=== WELEPHANT POOL ANALYSIS ===\n');
+    
+    const factory = new ethers.Contract(PANCAKE_FACTORY, FACTORY_ABI, provider);
+    const welephant = new ethers.Contract(WELEPHANT, ERC20_ABI, provider);
+    const elephant = new ethers.Contract(ELEPHANT, ERC20_ABI, provider);
+    
+    // Get decimals
+    const welephantDecimals = await welephant.decimals();
+    const elephantDecimals = await elephant.decimals();
+    
+    console.log('TOKEN INFO:');
+    console.log('- ELEPHANT decimals:', elephantDecimals);
+    console.log('- WELEPHANT decimals:', welephantDecimals);
+    console.log('- Decimal multiplier:', 10 ** (welephantDecimals - elephantDecimals));
+    
+    // Check for WELEPHANT pools
+    console.log('\nCHECKING FOR WELEPHANT POOLS:\n');
+    
+    const pairs = [
+        { name: 'WELEPHANT/WBNB', token0: WELEPHANT, token1: WBNB },
+        { name: 'WELEPHANT/ELEPHANT', token0: WELEPHANT, token1: ELEPHANT },
+        { name: 'WELEPHANT/BUSD', token0: WELEPHANT, token1: '0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56' }
+    ];
+    
+    for (const pairInfo of pairs) {
+        try {
+            const pairAddress = await factory.getPair(pairInfo.token0, pairInfo.token1);
+            
+            if (pairAddress === ethers.constants.AddressZero) {
+                console.log(`${pairInfo.name}: NO POOL`);
+                continue;
+            }
+            
+            const pair = new ethers.Contract(pairAddress, PAIR_ABI, provider);
+            const reserves = await pair.getReserves();
+            const token0 = await pair.token0();
+            
+            const reserve0 = reserves.reserve0;
+            const reserve1 = reserves.reserve1;
+            
+            console.log(`${pairInfo.name}: POOL EXISTS`);
+            console.log(`  Address: ${pairAddress}`);
+            console.log(`  Reserve0: ${ethers.utils.formatUnits(reserve0, 18)}`);
+            console.log(`  Reserve1: ${ethers.utils.formatUnits(reserve1, 18)}`);
+            
+            // Check if there's liquidity
+            if (reserve0.gt(0) && reserve1.gt(0)) {
+                console.log('  Status: HAS LIQUIDITY ✓');
+                
+                // Calculate price
+                const price = token0.toLowerCase() === pairInfo.token0.toLowerCase()
+                    ? reserve1.mul(ethers.utils.parseUnits('1', 18)).div(reserve0)
+                    : reserve0.mul(ethers.utils.parseUnits('1', 18)).div(reserve1);
+                
+                console.log(`  Price: ${ethers.utils.formatUnits(price, 18)}`);
+            } else {
+                console.log('  Status: NO LIQUIDITY');
+            }
+            
+        } catch (error) {
+            console.log(`${pairInfo.name}: ERROR - ${error.message}`);
+        }
+        console.log('');
+    }
+    
+    // Check ELEPHANT/WBNB price for comparison
+    console.log('\nELEPHANT/WBNB REFERENCE PRICE:');
+    const elephantPair = await factory.getPair(ELEPHANT, WBNB);
+    if (elephantPair !== ethers.constants.AddressZero) {
+        const pair = new ethers.Contract(elephantPair, PAIR_ABI, provider);
+        const reserves = await pair.getReserves();
+        const token0 = await pair.token0();
+        
+        const elephantReserve = token0.toLowerCase() === ELEPHANT.toLowerCase() 
+            ? reserves.reserve0 
+            : reserves.reserve1;
+        const wbnbReserve = token0.toLowerCase() === ELEPHANT.toLowerCase() 
+            ? reserves.reserve1 
+            : reserves.reserve0;
+        
+        // Price in WBNB per ELEPHANT (accounting for 9 decimals)
+        const elephantPrice = wbnbReserve.mul(ethers.utils.parseUnits('1', 9)).div(elephantReserve);
+        
+        console.log('- ELEPHANT Reserve:', ethers.utils.formatUnits(elephantReserve, 9));
+        console.log('- WBNB Reserve:', ethers.utils.formatEther(wbnbReserve));
+        console.log('- Price: 1 ELEPHANT =', ethers.utils.formatEther(elephantPrice), 'WBNB');
+        
+        // Expected WELEPHANT price (should be same as ELEPHANT)
+        console.log('\nEXPECTED WELEPHANT PRICE:');
+        console.log('- 1 WELEPHANT should = 1 ELEPHANT =', ethers.utils.formatEther(elephantPrice), 'WBNB');
+        console.log('- (minus 2% wrap fee + 2% unwrap fee = 4% total)');
+    }
+    
+    console.log('\n=== EXPLOIT ANALYSIS ===');
+    console.log('\nFor decimal exploit to work, we need:');
+    console.log('1. WELEPHANT pool with incorrect decimal handling');
+    console.log('2. Price discrepancy > 4% (to beat wrap/unwrap fees)');
+    console.log('3. Sufficient liquidity for arbitrage');
+    
+    console.log('\nCURRENT STATUS:');
+    console.log('- Checking if any pools exist with exploitable decimal confusion...');
+}
+
+checkWElephantPools().catch(console.error);

package/check-xfi-pool.js

@@ -0,0 +1,75 @@
+// Check XFI Staking pool state
+const ethers = require('ethers');
+
+const STAKING = '0x5cD1C00a88822182733E3ac335863fcC9A1c0705';
+const XFI = '0x5BEfBB272290dD5b8521D4a938f6c4757742c430';
+
+const STAKING_ABI = [
+    'function totalStakes() view returns (uint256)',
+    'function totalDividends() view returns (uint256)',
+    'function yourStakedXFI(address) view returns (uint256)',
+    'function getPendingReward(address) view returns (uint256)'
+];
+
+const XFI_ABI = [
+    'function balanceOf(address) view returns (uint256)'
+];
+
+async function main() {
+    const provider = new ethers.providers.JsonRpcProvider(
+        'https://mainnet.infura.io/v3/db4d2c885bc946b691dbb3d5ef26d9e2'
+    );
+    
+    const staking = new ethers.Contract(STAKING, STAKING_ABI, provider);
+    const xfi = new ethers.Contract(XFI, XFI_ABI, provider);
+    
+    console.log('=== XFI STAKING POOL STATE ===\n');
+    
+    // Check pool state
+    const totalStakes = await staking.totalStakes();
+    const totalDividends = await staking.totalDividends();
+    const stakingBalance = await xfi.balanceOf(STAKING);
+    
+    console.log('Total Staked:', ethers.utils.formatEther(totalStakes), 'XFI');
+    console.log('Total Dividends:', ethers.utils.formatEther(totalDividends), 'XFI');
+    console.log('Contract Balance:', ethers.utils.formatEther(stakingBalance), 'XFI');
+    
+    // Check your exploit contract
+    const exploitContract = '0x1a64ec202b8e0bdd73f53820ce6d6b30885c0d0e';
+    const yourStaked = await staking.yourStakedXFI(exploitContract);
+    const yourPending = await staking.getPendingReward(exploitContract);
+    const yourBalance = await xfi.balanceOf(exploitContract);
+    
+    console.log('\n=== YOUR EXPLOIT CONTRACT ===\n');
+    console.log('Address:', exploitContract);
+    console.log('XFI Balance:', ethers.utils.formatEther(yourBalance), 'XFI');
+    console.log('Staked:', ethers.utils.formatEther(yourStaked), 'XFI');
+    console.log('Pending Rewards:', ethers.utils.formatEther(yourPending), 'XFI');
+    
+    // Diagnosis
+    console.log('\n=== DIAGNOSIS ===\n');
+    
+    if (totalDividends.eq(0)) {
+        console.log('❌ PROBLEM: Pool has NO REWARDS!');
+        console.log('   The exploit needs existing rewards in the pool.');
+        console.log('   Solution: Wait for someone to call ADDFUNDS() or for fees to accumulate.');
+    }
+    
+    if (totalStakes.eq(0)) {
+        console.log('❌ PROBLEM: Pool is EMPTY!');
+        console.log('   No one has staked yet.');
+        console.log('   Solution: Wait for other users to stake first.');
+    }
+    
+    if (yourStaked.gt(0) && yourPending.eq(0)) {
+        console.log('⚠️  You have staked but no pending rewards.');
+        console.log('   This means the pool has no rewards to distribute.');
+    }
+    
+    if (totalDividends.gt(0) && totalStakes.gt(0)) {
+        console.log('✅ Pool has rewards! Exploit should work.');
+        console.log('   Expected profit per stake:', ethers.utils.formatEther(totalDividends.div(totalStakes.div(ethers.utils.parseEther('1')))), 'XFI per 1 XFI staked');
+    }
+}
+
+main().catch(console.error);

package/check-zypher.js

@@ -0,0 +1,32 @@
+const { ethers } = require('ethers');
+
+const RPC = 'https://bsc-mainnet.infura.io/v3/db4d2c885bc946b691dbb3d5ef26d9e2';
+const TOKEN = '0xa3cfb853339b77f385b994799b015cb04b208fe6';
+
+const ABI = [
+  'function name() view returns (string)',
+  'function symbol() view returns (string)',
+  'function totalSupply() view returns (uint256)',
+  'function cap() view returns (uint256)',
+  'function owner() view returns (address)',
+  'function pendingOwner() view returns (address)',
+  'function balanceOf(address) view returns (uint256)'
+];
+
+async function check() {
+  const provider = new ethers.providers.JsonRpcProvider(RPC);
+  const token = new ethers.Contract(TOKEN, ABI, provider);
+  
+  console.log('=== Zypher Network Token (POP) ===');
+  console.log('Name:', await token.name());
+  console.log('Symbol:', await token.symbol());
+  console.log('Total Supply:', ethers.utils.formatEther(await token.totalSupply()), 'POP');
+  console.log('Cap:', ethers.utils.formatEther(await token.cap()), 'POP');
+  console.log('Owner:', await token.owner());
+  console.log('Pending Owner:', await token.pendingOwner());
+  
+  const owner = await token.owner();
+  console.log('Owner Balance:', ethers.utils.formatEther(await token.balanceOf(owner)), 'POP');
+}
+
+check().catch(console.error);

package/check_proxy.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+PROXY="0xa10bfbdf1b2124d8789f0cf5dc8eccfb9ca5ef2a"
+RPC="https://bsc-dataseed.binance.org/"
+
+echo "=== PROXY INITIALIZATION CHECK ==="
+echo ""
+echo "Proxy Address: $PROXY"
+echo "Implementation: 0xe22ed23c155ae92e46ac11e0d9ab90d1c51e1dd7"
+echo "Admin: 0xf309bc7ceb3ba0d8a91f42c7c4f12e6df4b371a4"
+echo ""
+
+# Try common initialization check functions
+echo "Checking common functions..."
+echo ""
+
+# Check if initialized
+cast call $PROXY "initialized()(bool)" --rpc-url $RPC 2>/dev/null && echo "✓ Has initialized() function" || echo "✗ No initialized() function"
+
+# Check owner
+cast call $PROXY "owner()(address)" --rpc-url $RPC 2>/dev/null && echo "✓ Has owner() function" || echo "✗ No owner() function"
+
+# Check admin  
+cast call $PROXY "admin()(address)" --rpc-url $RPC 2>/dev/null && echo "✓ Has admin() function" || echo "✗ No admin() function"
+
+# Check paused
+cast call $PROXY "paused()(bool)" --rpc-url $RPC 2>/dev/null && echo "✓ Has paused() function" || echo "✗ No paused() function"
+
+echo ""
+echo "Checking storage slots..."
+# Check common initialization slots
+for slot in 0 1 2 3 4 5; do
+    value=$(cast storage $PROXY $slot --rpc-url $RPC 2>/dev/null)
+    echo "Slot $slot: $value"
+done
+

package/compare-tlm-chains.js

@@ -0,0 +1,90 @@
+const { ethers } = require('ethers');
+
+const ethProvider = new ethers.providers.JsonRpcProvider('https://mainnet.infura.io/v3/db4d2c885bc946b691dbb3d5ef26d9e2');
+const bscProvider = new ethers.providers.JsonRpcProvider('https://bsc-dataseed1.binance.org');
+
+const ethAddress = '0x888888848B652B3E3a0f34c96E00EEC0F3a23F72';
+const bscAddress = '0x2222227E22102Fe3322098e4CBfE18cFebD57c95';
+
+const abi = [
+  'function name() view returns (string)',
+  'function symbol() view returns (string)',
+  'function decimals() view returns (uint8)',
+  'function totalSupply() view returns (uint256)',
+  'function owner() view returns (address)',
+  'function threshold() view returns (uint256)'
+];
+
+async function main() {
+  const ethTLM = new ethers.Contract(ethAddress, abi, ethProvider);
+  const bscTLM = new ethers.Contract(bscAddress, abi, bscProvider);
+  
+  console.log('=== TLM Cross-Chain Comparison ===\n');
+  
+  console.log('ETHEREUM:');
+  try {
+    const ethName = await ethTLM.name();
+    const ethSymbol = await ethTLM.symbol();
+    const ethDecimals = await ethTLM.decimals();
+    const ethSupply = await ethTLM.totalSupply();
+    const ethOwner = await ethTLM.owner();
+    const ethThreshold = await ethTLM.threshold();
+    
+    console.log('Name:', ethName);
+    console.log('Symbol:', ethSymbol);
+    console.log('Decimals:', ethDecimals);
+    console.log('Total Supply:', ethers.utils.formatUnits(ethSupply, ethDecimals), 'TLM');
+    console.log('Owner:', ethOwner);
+    console.log('Threshold:', ethThreshold.toString());
+  } catch (e) {
+    console.log('Error:', e.message);
+  }
+  
+  console.log('\nBSC:');
+  try {
+    const bscName = await bscTLM.name();
+    const bscSymbol = await bscTLM.symbol();
+    const bscDecimals = await bscTLM.decimals();
+    const bscSupply = await bscTLM.totalSupply();
+    const bscOwner = await bscTLM.owner();
+    const bscThreshold = await bscTLM.threshold();
+    
+    console.log('Name:', bscName);
+    console.log('Symbol:', bscSymbol);
+    console.log('Decimals:', bscDecimals);
+    console.log('Total Supply:', ethers.utils.formatUnits(bscSupply, bscDecimals), 'TLM');
+    console.log('Owner:', bscOwner);
+    console.log('Threshold:', bscThreshold.toString());
+  } catch (e) {
+    console.log('Error:', e.message);
+  }
+  
+  console.log('\n=== Cross-Chain Analysis ===');
+  
+  const ethSupply = await ethTLM.totalSupply();
+  const bscSupply = await bscTLM.totalSupply();
+  const ethDecimals = await ethTLM.decimals();
+  const bscDecimals = await bscTLM.decimals();
+  
+  const ethSupplyFormatted = parseFloat(ethers.utils.formatUnits(ethSupply, ethDecimals));
+  const bscSupplyFormatted = parseFloat(ethers.utils.formatUnits(bscSupply, bscDecimals));
+  const totalSupply = ethSupplyFormatted + bscSupplyFormatted;
+  
+  console.log('ETH Supply:', ethSupplyFormatted.toFixed(4), 'TLM');
+  console.log('BSC Supply:', bscSupplyFormatted.toFixed(4), 'TLM');
+  console.log('Total Supply:', totalSupply.toFixed(4), 'TLM');
+  console.log('Max Supply: 10,000,000,000 TLM (from docs)');
+  
+  const ethOwner = await ethTLM.owner();
+  const bscOwner = await bscTLM.owner();
+  
+  console.log('\nOwners Match:', ethOwner.toLowerCase() === bscOwner.toLowerCase());
+  console.log('Decimals Match:', ethDecimals === bscDecimals);
+  
+  if (ethDecimals !== bscDecimals) {
+    console.log('\n⚠️  CRITICAL: Decimals mismatch between chains!');
+    console.log('This could cause issues in cross-chain transfers');
+  }
+}
+
+main().catch(console.error);