uups-checker 1.0.0

package/decode-stake-tx.js

@@ -0,0 +1,50 @@
+const { ethers } = require('ethers');
+
+const RPC = 'https://bsc-mainnet.infura.io/v3/db4d2c885bc946b691dbb3d5ef26d9e2';
+const TX_HASH = '0x91ef5d88224e7a9d622ffeb8d598c3b0b77d9bd2eaf8ecd1e45df3ce24b88b0e';
+
+async function main() {
+    const provider = new ethers.providers.JsonRpcProvider(RPC);
+    
+    console.log('=== Decoding Recent Stake Transaction ===');
+    console.log('TX:', TX_HASH);
+    
+    const tx = await provider.getTransaction(TX_HASH);
+    console.log('\nFrom:', tx.from);
+    console.log('To:', tx.to);
+    console.log('Value:', tx.value.toString());
+    console.log('Data:', tx.data);
+    console.log('Data length:', tx.data.length);
+    
+    // Decode function selector
+    const selector = tx.data.slice(0, 10);
+    console.log('\nFunction selector:', selector);
+    
+    // Try to decode parameters
+    if (tx.data.length > 10) {
+        const params = tx.data.slice(10);
+        console.log('Parameters (hex):', params);
+        
+        // Try to decode as (uint256, uint256, uint8, address)
+        try {
+            const decoded = ethers.utils.defaultAbiCoder.decode(
+                ['uint256', 'uint256', 'uint8'],
+                '0x' + params
+            );
+            console.log('\nDecoded as (uint256, uint256, uint8):');
+            console.log('Param 1 (amount):', decoded[0].toString(), '=', ethers.utils.formatEther(decoded[0]), 'tokens');
+            console.log('Param 2 (amount2):', decoded[1].toString(), '=', ethers.utils.formatEther(decoded[1]), 'tokens');
+            console.log('Param 3 (type):', decoded[2]);
+        } catch (e) {
+            console.log('Failed to decode:', e.message);
+        }
+    }
+    
+    // Get receipt to see events
+    const receipt = await provider.getTransactionReceipt(TX_HASH);
+    console.log('\nStatus:', receipt.status === 1 ? 'SUCCESS' : 'FAILED');
+    console.log('Gas used:', receipt.gasUsed.toString());
+    console.log('Events:', receipt.logs.length);
+}
+
+main().catch(console.error);

package/deep-analyze-lock.js

@@ -0,0 +1,82 @@
+const ethers = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://bsc-dataseed.binance.org/');
+
+async function deepAnalyze() {
+    const lockAddress = '0x7536592bb74b5d62eb82e8b93b17eed4eed9a85c';
+    const noraToken = '0x1f39dd2bf5a27e2d4ed691dcf933077371777cb0';
+    
+    // Function selector 0x315a095d is withdrawTokens(uint256)
+    const lockContract = new ethers.Contract(lockAddress, [
+        'function withdrawTokens(uint256) external',
+        'function depositedTokens(address) view returns (uint256)',
+        'function tokensLocked(address) view returns (uint256)',
+        'function tokenLocks(address,uint256) view returns (uint256,uint256,uint256,uint256,uint256,address,bool)',
+        'function getDepositsByWithdrawalAddress(address) view returns (uint256[])',
+        'function getDepositsByTokenAddress(address) view returns (uint256[])',
+        'function owner() view returns (address)'
+    ], provider);
+    
+    console.log('=== NORA LOCK CONTRACT ANALYSIS ===\n');
+    
+    try {
+        const owner = await lockContract.owner();
+        console.log('Owner:', owner);
+    } catch (e) {
+        console.log('Owner check failed');
+    }
+    
+    try {
+        const deposited = await lockContract.depositedTokens(noraToken);
+        console.log('Deposited NORA tokens:', ethers.utils.formatEther(deposited));
+    } catch (e) {
+        console.log('No depositedTokens() function');
+    }
+    
+    try {
+        const locked = await lockContract.tokensLocked(noraToken);
+        console.log('Locked NORA tokens:', ethers.utils.formatEther(locked));
+    } catch (e) {
+        console.log('No tokensLocked() function');
+    }
+    
+    // Try to get deposits for NORA token
+    try {
+        const deposits = await lockContract.getDepositsByTokenAddress(noraToken);
+        console.log('\nDeposit IDs for NORA:', deposits.map(d => d.toString()));
+        
+        // Check first few deposits
+        for (let i = 0; i < Math.min(3, deposits.length); i++) {
+            try {
+                const lock = await lockContract.tokenLocks(noraToken, deposits[i]);
+                console.log(`\nDeposit ${deposits[i]}:`);
+                console.log('  Amount:', ethers.utils.formatEther(lock[0]));
+                console.log('  Unlock time:', new Date(lock[1].toNumber() * 1000).toISOString());
+                console.log('  Withdrawn:', lock[6]);
+            } catch (e) {
+                console.log(`  Error reading deposit ${deposits[i]}`);
+            }
+        }
+    } catch (e) {
+        console.log('\nNo getDepositsByTokenAddress() function:', e.message);
+    }
+    
+    // Check some test users
+    const testUsers = [
+        '0xcBB8A4d526D0c664E26D0c664E',
+        '0x4e84E92C6221b638599504a89E7B664eA86386A0' // owner
+    ];
+    
+    for (const user of testUsers) {
+        try {
+            const userDeposits = await lockContract.getDepositsByWithdrawalAddress(user);
+            if (userDeposits.length > 0) {
+                console.log(`\nUser ${user} has ${userDeposits.length} deposits:`, userDeposits.map(d => d.toString()));
+            }
+        } catch (e) {
+            // Silent fail
+        }
+    }
+}
+
+deepAnalyze().catch(console.error);

package/dune_uups_proxy_query.sql

@@ -0,0 +1,42 @@
+-- Dune Query: UUPS Proxy Scanner for BSC (Aggressive v3)
+-- Finds UUPS proxies sorted by balance
+-- Date range: 2020-2026, No creation filter, All-time balance
+
+WITH uups_candidates AS (
+  SELECT DISTINCT
+    t."to" AS contract_address
+  FROM bnb.traces t
+  WHERE 1=1
+    -- upgradeTo: 0x3659cfe6, upgradeToAndCall: 0x4f1ef286
+    AND (
+      bytearray_substring(t.input, 1, 4) = 0x3659cfe6
+      OR bytearray_substring(t.input, 1, 4) = 0x4f1ef286
+    )
+    AND t.success = true
+    AND t.block_time >= CAST('2020-01-01' AS TIMESTAMP)
+    AND t.block_time < CAST('2026-12-31' AS TIMESTAMP)
+    AND t.type = 'call'
+    AND t."to" IS NOT NULL
+  LIMIT 2000
+),
+
+-- Get current BNB balance from ALL traces (no time limit)
+contract_balances AS (
+  SELECT
+    t."to" AS contract_address,
+    SUM(CAST(t.value AS DOUBLE)) / 1e18 AS total_received
+  FROM bnb.traces t
+  WHERE t."to" IN (SELECT contract_address FROM uups_candidates)
+    AND t.success = true
+    AND t.value > 0
+    AND t.block_time >= CAST('2020-01-01' AS TIMESTAMP)
+  GROUP BY t."to"
+)
+
+SELECT
+  CONCAT('<a href="https://bscscan.com/address/', CAST(cb.contract_address AS VARCHAR), '" target="_blank">', CAST(cb.contract_address AS VARCHAR), '</a>') AS contract_link,
+  ROUND(cb.total_received, 4) AS bnb_received
+FROM contract_balances cb
+WHERE cb.total_received > 0
+ORDER BY cb.total_received DESC
+LIMIT 300;

package/echidna/alpha-proxy.yaml

@@ -0,0 +1,14 @@
+testMode: assertion
+testLimit: 100000
+timeout: 600
+shrinkLimit: 5000
+seqLen: 100
+contractAddr: "0x00a329c0648769A73afAc7F9381E08FB43dBEA72"
+deployer: "0x00a329c0648769a73afac7f9381e08fb43dbea70"
+sender: ["0x10000", "0x20000", "0x30000", "0xb8AF5A48Fefa0e696B54839A2a74EceB6d8abB51"]
+balanceAddr: 0xffffffff
+balanceContract: 100000000000000000000
+codeSize: 0x6000
+corpusDir: "echidna-corpus"
+coverage: true
+allContracts: true

package/echidna/elephant.yaml

@@ -0,0 +1,7 @@
+testMode: assertion
+testLimit: 50000
+deployer: "0x30000"
+sender: ["0x10000", "0x20000", "0x30000"]
+cryticArgs: ["--solc-remaps", "@openzeppelin=node_modules/@openzeppelin"]
+rpcUrl: "https://bsc-dataseed.binance.org/"
+rpcBlock: latest

package/echidna/lendflare.yaml

@@ -0,0 +1,42 @@
+# Echidna configuration for LendFlare Token fuzzing
+# Run with: echidna echidna/LendFlareTokenEchidna.sol --contract LendFlareTokenEchidna --config echidna/lendflare.yaml
+
+# Test configuration
+testMode: assertion
+testLimit: 50000
+timeout: 300
+
+# Coverage
+coverage: true
+corpusDir: "echidna-corpus"
+
+# Shrinking
+shrinkLimit: 5000
+
+# Transaction sequence
+seqLen: 100
+contractAddr: "0x00a329c0648769a73afac7f9381e08fb43dbea72"
+
+# Solver
+solver: z3
+
+# Output
+format: text
+quiet: false
+
+# Specific to LendFlare testing
+cryticArgs: ["--solc-remaps", "@openzeppelin=node_modules/@openzeppelin"]
+
+# Filter functions to test
+filterBlacklist: false
+filterFunctions: []
+
+# Deployment
+deployer: "0x10000"
+sender: ["0x10000", "0x20000", "0x30000"]
+
+# Multi-abi support
+multi-abi: false
+
+# Optimization
+optimize: true

package/echidna.config.yaml

@@ -0,0 +1,12 @@
+testMode: property
+testLimit: 50000
+shrinkLimit: 5000
+seqLen: 100
+contractAddr: "0x00a329c0648769A73afAc7F9381E08FB43dBEA72"
+deployer: "0x10000"
+sender: ["0x10000", "0x20000", "0x30000"]
+psender: "0x10000"
+prefix: "echidna_"
+cryticArgs: ["--solc-remaps", "@openzeppelin=lib/openzeppelin-contracts"]
+corpusDir: "echidna-corpus"
+coverage: true

package/elephant_raw.json

@@ -0,0 +1 @@
+{"status":"0","message":"NOTOK","result":"You are using a deprecated V1 endpoint, switch to Etherscan API V2 using https://docs.etherscan.io/v2-migration"}

package/eps_raw.json

@@ -0,0 +1 @@
+{"status":"0","message":"NOTOK","result":"You are using a deprecated V1 endpoint, switch to Etherscan API V2 using https://docs.etherscan.io/v2-migration"}

package/exploit/.github/workflows/test.yml

@@ -0,0 +1,38 @@
+name: CI
+
+permissions: {}
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+env:
+  FOUNDRY_PROFILE: ci
+
+jobs:
+  check:
+    name: Foundry project
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+
+      - name: Show Forge version
+        run: forge --version
+
+      - name: Run Forge fmt
+        run: forge fmt --check
+
+      - name: Run Forge build
+        run: forge build --sizes
+
+      - name: Run Forge tests
+        run: forge test -vvv

package/exploit/.gitmodules

@@ -0,0 +1,3 @@
+[submodule "lib/forge-std"]
+	path = lib/forge-std
+	url = https://github.com/foundry-rs/forge-std

package/exploit/README.md

@@ -0,0 +1,66 @@
+## Foundry
+
+**Foundry is a blazing fast, portable and modular toolkit for Ethereum application development written in Rust.**
+
+Foundry consists of:
+
+- **Forge**: Ethereum testing framework (like Truffle, Hardhat and DappTools).
+- **Cast**: Swiss army knife for interacting with EVM smart contracts, sending transactions and getting chain data.
+- **Anvil**: Local Ethereum node, akin to Ganache, Hardhat Network.
+- **Chisel**: Fast, utilitarian, and verbose solidity REPL.
+
+## Documentation
+
+https://book.getfoundry.sh/
+
+## Usage
+
+### Build
+
+```shell
+$ forge build
+```
+
+### Test
+
+```shell
+$ forge test
+```
+
+### Format
+
+```shell
+$ forge fmt
+```
+
+### Gas Snapshots
+
+```shell
+$ forge snapshot
+```
+
+### Anvil
+
+```shell
+$ anvil
+```
+
+### Deploy
+
+```shell
+$ forge script script/Counter.s.sol:CounterScript --rpc-url <your_rpc_url> --private-key <your_private_key>
+```
+
+### Cast
+
+```shell
+$ cast <subcommand>
+```
+
+### Help
+
+```shell
+$ forge --help
+$ anvil --help
+$ cast --help
+```

package/exploit/foundry.lock

@@ -0,0 +1,8 @@
+{
+  "lib/forge-std": {
+    "tag": {
+      "name": "v1.15.0",
+      "rev": "0844d7e1fc5e60d77b68e469bff60265f236c398"
+    }
+  }
+}

package/exploit/lib/forge-std/.gitattributes

@@ -0,0 +1 @@
+src/Vm.sol linguist-generated

package/exploit/lib/forge-std/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @danipopes @klkvr @mattsse @grandizzy @yash-atreya @zerosnacks @onbjerg @0xrusowsky

package/exploit/lib/forge-std/.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

package/exploit/lib/forge-std/.github/workflows/ci.yml

@@ -0,0 +1,125 @@
+name: CI
+
+permissions: {}
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  build:
+    name: build +${{ matrix.toolchain }} ${{ matrix.flags }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain: [stable, nightly]
+        flags:
+          - ""
+          - --via-ir
+          - --use solc:0.8.33 --via-ir
+          - --use solc:0.8.33
+          - --use solc:0.8.13 --via-ir
+          - --use solc:0.8.13
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: ${{ matrix.toolchain }}
+      - run: forge --version
+      - run: forge build -vvvvv --skip test --deny warnings ${{ matrix.flags }} --contracts 'test/compilation/*'
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain: [stable, nightly]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: ${{ matrix.toolchain }}
+      - run: forge --version
+      - run: forge test -vvv
+
+  fmt:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: foundry-rs/foundry-toolchain@v1
+      - run: forge --version
+      - run: forge fmt --check
+
+  typos:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: crate-ci/typos@78bc6fb2c0d734235d57a2d6b9de923cc325ebdd # v1
+
+  codeql:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"
+
+  ci-success:
+    runs-on: ubuntu-latest
+    if: always()
+    needs:
+      - build
+      - test
+      - fmt
+      - typos
+      - codeql
+    timeout-minutes: 10
+    steps:
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}

package/exploit/lib/forge-std/.github/workflows/sync.yml

@@ -0,0 +1,36 @@
+name: Sync Release Branch
+
+permissions: {}
+
+on:
+  release:
+    types:
+      - created
+
+jobs:
+  sync-release-branch:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    if: startsWith(github.event.release.tag_name, 'v1')
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: true
+          fetch-depth: 0
+          ref: v1
+
+      # The email is derived from the bots user id,
+      # found here: https://api.github.com/users/github-actions%5Bbot%5D
+      - name: Configure Git
+        run: |
+          git config user.name github-actions[bot]
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+
+      - name: Sync Release Branch
+        run: |
+          git fetch --tags
+          git checkout v1
+          git reset --hard ${GITHUB_REF}
+          git push --force