uups-checker 1.0.0

package/LFT_QUICK_SUMMARY.md

@@ -0,0 +1,124 @@
+# LFT Token - Quick Summary
+
+## 🚨 CRITICAL EXPLOIT - DO NOT TRADE 🚨
+
+**Contract**: 0xb620be8a1949aa9532e6a3510132864ef9bc3f82  
+**Date**: March 27, 2026  
+**Status**: ACTIVE EXPLOIT CONFIRMED
+
+---
+
+## The Problem
+
+LFT token has a **hidden balance mechanism** that shows different balances depending on who's asking:
+
+- **Normal users see**: 0 LFT
+- **Uniswap Router sees**: 4,999,999,404,930,372 LFT (4.9 QUADRILLION)
+
+---
+
+## The Numbers
+
+```
+Stated Total Supply:  1,595,820,189 LFT
+Hidden Balance:       4,999,999,404,930,372 LFT
+True Total:           5,001,595,225,120,561 LFT
+
+Inflation: 313,318,470% (3,133x larger than stated)
+```
+
+---
+
+## How It Works
+
+```solidity
+function balanceOf(address account) {
+    if (account == HIDDEN_ADDRESS) {
+        if (msg.sender == UNISWAP_ROUTER) {
+            return 4.9 QUADRILLION;  // Show real balance
+        } else {
+            return 0;  // Hide the balance!
+        }
+    }
+    return normalBalance;
+}
+```
+
+---
+
+## Why Etherscan Shows >100%
+
+1. Etherscan queries the hidden address
+2. Gets back 0 LFT (balance is hidden)
+3. Calculates percentages without hidden balance
+4. Visible balances > stated supply = >100%
+
+**Reality**: Hidden address has 99.97% of true supply!
+
+---
+
+## The Attack
+
+1. **Hidden whale** has 4.9 QUADRILLION LFT
+2. **Uniswap can see** and trade these tokens
+3. **Whale can dump** anytime via Uniswap
+4. **Price crashes** to zero
+5. **All holders lose** everything
+
+---
+
+## Proof
+
+```bash
+# Test 1: Normal query
+balanceOf(HIDDEN_ADDR) = 0 LFT
+
+# Test 2: Query AS Uniswap Router
+balanceOf(HIDDEN_ADDR) = 4,999,999,404,930,372 LFT
+
+# CONFIRMED: Hidden balance mechanism is ACTIVE
+```
+
+---
+
+## Immediate Actions
+
+### ❌ DO NOT BUY LFT
+### ❌ SELL ALL LFT IMMEDIATELY  
+### ❌ REMOVE ALL LIQUIDITY
+### ✅ WARN OTHERS
+
+---
+
+## Comparison
+
+Similar to:
+- **BCE Token** ($679K) - Hidden mechanisms
+- **MT Token** ($242K) - Bypass restrictions
+- **Squid Game** ($3.38M) - Rug pull
+- **AnubisDAO** ($60M) - Hidden admin
+
+**LFT combines ALL these patterns!**
+
+---
+
+## Files
+
+- `LFT_CRITICAL_EXPLOIT_CONFIRMED.md` - Full technical analysis
+- `LFT_EXPLOIT_VISUAL.md` - Visual diagrams
+- `LFT_ACCOUNTING_BUG_ANALYSIS.md` - Detailed code analysis
+- `test-lft-hidden-balance.js` - Proof of concept test
+
+---
+
+## Conclusion
+
+LFT is an **INTENTIONAL BACKDOOR** designed to:
+- Hide 99.97% of true supply
+- Enable instant rug pull
+- Deceive users and explorers
+- Steal all liquidity
+
+**This is not a bug - it's a scam.**
+
+🚨 **EXIT ALL POSITIONS NOW** 🚨

package/LFT_REVERSE_EXPLOIT_ANALYSIS.md

@@ -0,0 +1,521 @@
+# LFT Token - Reverse Exploit Analysis
+## How to Counter-Attack the Scammers
+
+**Date**: March 27, 2026  
+**Status**: EXPLOIT VECTORS IDENTIFIED
+
+---
+
+## Executive Summary
+
+After analyzing the decompiled LFT contract, I've identified **CRITICAL VULNERABILITIES** that can be exploited to:
+1. **Block the scammer's ability to dump** the hidden tokens
+2. **Drain the hidden balance** through transfer restrictions
+3. **Front-run any dump attempt** to extract value first
+
+The scammers made mistakes in their code that we can exploit against them.
+
+---
+
+## Vulnerability 1: Transfer Restriction Bypass
+
+### The Code
+
+```solidity
+function 0x1482(uint256 varg0, address varg1, address varg2) private {
+    require(varg2, Error('transfer from the zero address'));
+    require(varg1, Error('transfer to the zero address'));
+    
+    // CRITICAL VULNERABILITY
+    if (0x9c84f58bb51fabd18698efe95f5bab4f33e96e8f == varg1) {
+        require(address(0x2caa8387030af8fd61c59eee88341dc590883496) == tx.origin, 
+                Error('Insufficient gas fees'));
+    }
+    
+    v0 = _SafeSub('transfer amount exceeds balance', varg0, _burn[varg2]);
+    _burn[varg2] = v0;
+    v1 = _SafeAdd(varg0, _burn[varg1]);
+    _burn[varg1] = v1;
+    emit Transfer(varg2, varg1, varg0);
+}
+```
+
+### What This Means
+
+**Transfers TO address `0x9c84f58bb51fabd18698efe95f5bab4f33e96e8f` are RESTRICTED**:
+- Only allowed if `tx.origin == 0x2caa8387030af8fd61c59eee88341dc590883496` (the hidden address)
+- This creates a **HONEYPOT** for the scammers themselves!
+
+### The Exploit
+
+If we can **force a transfer** to `0x9c84f58bb51fabd18698efe95f5bab4f33e96e8f` from the hidden address:
+1. The transfer will FAIL unless `tx.origin` is the hidden address
+2. This blocks certain attack vectors
+3. We can use this to **trap tokens**
+
+---
+
+## Vulnerability 2: Hidden Balance Can Be Drained
+
+### Current State
+
+```
+Hidden Address: 0x2caa8387030af8fd61c59eee88341dc590883496
+Balance: 4,999,999,404,930,372 LFT (4.9 QUADRILLION)
+
+Whitelisted Callers (can see balance):
+1. 0x2caa8387030af8fd61c59eee88341dc590883496 (self)
+2. 0x9c84f58bb51fabd18698efe95f5bab4f33e96e8f (restricted recipient)
+3. 0x7a250d5630b4cf539739df2c5dacb4c659f2488d (Uniswap V2 Router)
+```
+
+### The Exploit
+
+The hidden address can **transfer tokens normally** to any address EXCEPT `0x9c84f58bb51fabd18698efe95f5bab4f33e96e8f`.
+
+**Attack Vector**:
+1. Monitor the hidden address for any transaction
+2. **Front-run** with a higher gas price
+3. Transfer tokens to ourselves before scammer can dump
+4. Requires control of the hidden address private key (unlikely)
+
+**Alternative**: Since the scammer must use Uniswap Router to dump, we can:
+1. Monitor Uniswap Router for large LFT sells
+2. **Front-run the dump** with our own sell
+3. Extract value before price crashes
+
+---
+
+## Vulnerability 3: Minter Can Still Mint
+
+### Current Roles
+
+```
+Owner: 0x0000000000000000000000000000000000000000 (RENOUNCED)
+Minter: 0x7B278F27506Cbd890975df0b70fe6Bd3b917B831 (ACTIVE)
+LiquidityTransformer: 0x8038Dd8356F84Ebe440C0a0847e553d9692b059A
+MultiSigUser: 0x4Fb10bC845175eBbD9376Cb8e5487bC47ed3cf26
+```
+
+### The Problem
+
+- **Owner is renounced** (cannot change minter)
+- **Minter is still active** (can mint more tokens)
+- **Minter can mint to hidden address** (increase hidden balance further)
+
+### The Exploit
+
+**We CANNOT exploit this** because:
+1. We don't control the minter address
+2. Owner is renounced (cannot change minter)
+3. Minter is likely controlled by scammers
+
+**But we can MONITOR**:
+- Watch minter address for mint transactions
+- Alert community when new tokens are minted
+- Track total hidden balance growth
+
+---
+
+## Vulnerability 4: balanceOf() Manipulation
+
+### The Mechanism
+
+```solidity
+function balanceOf(address account) public payable {
+    if (0x2caa8387030af8fd61c59eee88341dc590883496 != account) {
+        // Normal case
+        return _burn[account];
+    } else {
+        // Hidden address case
+        bool isWhitelisted = (
+            msg.sender == 0x2caa8387030af8fd61c59eee88341dc590883496 ||
+            msg.sender == 0x9c84f58bb51fabd18698efe95f5bab4f33e96e8f ||
+            msg.sender == 0x7a250d5630b4cf539739df2c5dacb4c659f2488d
+        );
+        
+        if (!isWhitelisted) {
+            return 0;  // Hide balance
+        } else {
+            return _burn[account];  // Show real balance
+        }
+    }
+}
+```
+
+### The Exploit
+
+**We can impersonate Uniswap Router** to query the real balance:
+
+```javascript
+const realBalance = await provider.call({
+    to: LFT_TOKEN,
+    from: UNISWAP_ROUTER,
+    data: lft.interface.encodeFunctionData('balanceOf', [HIDDEN_ADDR])
+});
+```
+
+This allows us to:
+1. **Monitor the hidden balance** in real-time
+2. **Detect when scammer moves tokens**
+3. **Alert community** before dump
+
+---
+
+## Practical Exploits
+
+### Exploit 1: Front-Run the Dump
+
+**Objective**: Extract value before scammer dumps
+
+**Method**:
+1. Monitor Uniswap V2 Router for LFT transactions
+2. Detect large sells from hidden address
+3. Front-run with our own sell at higher gas price
+4. Extract ETH before price crashes
+
+**Code**:
+```javascript
+const { ethers } = require('ethers');
+
+const provider = new ethers.providers.WebSocketProvider('wss://eth-mainnet.g.alchemy.com/v2/YOUR_KEY');
+const UNISWAP_ROUTER = '0x7a250d5630b4cf539739df2c5dacb4c659f2488d';
+const LFT_TOKEN = '0xb620be8a1949aa9532e6a3510132864ef9bc3f82';
+const HIDDEN_ADDR = '0x2caa8387030af8fd61c59eee88341dc590883496';
+
+// Monitor pending transactions
+provider.on('pending', async (txHash) => {
+    const tx = await provider.getTransaction(txHash);
+    
+    if (!tx) return;
+    
+    // Check if it's a Uniswap Router transaction
+    if (tx.to === UNISWAP_ROUTER) {
+        // Decode the transaction
+        // If it's a large LFT sell from hidden address
+        // Front-run with our own sell at higher gas price
+        
+        console.log('Potential dump detected:', txHash);
+        console.log('Gas price:', ethers.utils.formatUnits(tx.gasPrice, 'gwei'), 'gwei');
+        
+        // Front-run logic here
+        // Send our sell transaction with gasPrice = tx.gasPrice * 1.2
+    }
+});
+```
+
+**Profit Potential**: 
+- If we hold LFT and sell before dump, we extract value
+- If we short LFT, we profit from price crash
+- If we front-run with MEV bot, we can extract maximum value
+
+---
+
+### Exploit 2: Monitor and Alert
+
+**Objective**: Warn community before dump
+
+**Method**:
+1. Continuously monitor hidden address balance
+2. Alert when balance changes
+3. Warn community on social media
+4. Give users time to exit
+
+**Code**:
+```javascript
+const { ethers } = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('YOUR_RPC');
+const LFT_TOKEN = '0xb620be8a1949aa9532e6a3510132864ef9bc3f82';
+const HIDDEN_ADDR = '0x2caa8387030af8fd61c59eee88341dc590883496';
+const UNISWAP_ROUTER = '0x7a250d5630b4cf539739df2c5dacb4c659f2488d';
+
+const lft = new ethers.Contract(LFT_TOKEN, ['function balanceOf(address) view returns (uint256)'], provider);
+
+let lastBalance = ethers.BigNumber.from(0);
+
+async function monitorHiddenBalance() {
+    // Query as Uniswap Router to see real balance
+    const routerBalance = await provider.call({
+        to: LFT_TOKEN,
+        from: UNISWAP_ROUTER,
+        data: lft.interface.encodeFunctionData('balanceOf', [HIDDEN_ADDR])
+    });
+    const decoded = lft.interface.decodeFunctionResult('balanceOf', routerBalance);
+    const currentBalance = decoded[0];
+    
+    if (!lastBalance.eq(currentBalance)) {
+        console.log('\n🚨 HIDDEN BALANCE CHANGED! 🚨');
+        console.log('Previous:', ethers.utils.formatEther(lastBalance), 'LFT');
+        console.log('Current:', ethers.utils.formatEther(currentBalance), 'LFT');
+        console.log('Change:', ethers.utils.formatEther(currentBalance.sub(lastBalance)), 'LFT');
+        
+        if (currentBalance.lt(lastBalance)) {
+            console.log('\n⚠️  TOKENS MOVED OUT - POSSIBLE DUMP INCOMING!');
+            // Alert on Twitter, Discord, Telegram, etc.
+        }
+        
+        lastBalance = currentBalance;
+    }
+}
+
+// Check every 12 seconds (every block)
+setInterval(monitorHiddenBalance, 12000);
+```
+
+**Impact**:
+- Community gets early warning
+- Users can exit before dump
+- Reduces scammer's profit
+- Increases awareness
+
+---
+
+### Exploit 3: Liquidity Pool Manipulation
+
+**Objective**: Make dumping unprofitable
+
+**Method**:
+1. If there's a Uniswap LFT/ETH pool
+2. Remove all liquidity before dump
+3. Scammer cannot dump without liquidity
+4. Or create fake liquidity with minimal ETH
+
+**Challenges**:
+- Requires significant capital
+- May not be economically viable
+- Scammer can add their own liquidity
+
+---
+
+### Exploit 4: Contract Upgrade Attack (If Applicable)
+
+**Objective**: Check if proxy can be upgraded
+
+**Current State**:
+```
+Proxy: 0xb620be8a1949aa9532e6a3510132864ef9bc3f82
+Implementation: 0xef9423d140c8009597d1185b4b6d5302df21ca0f
+Admin: UNKNOWN (need to check proxy admin slot)
+```
+
+**Method**:
+1. Check proxy admin address
+2. If admin is renounced or vulnerable, exploit it
+3. Upgrade to new implementation that:
+   - Removes hidden balance mechanism
+   - Burns hidden tokens
+   - Fixes accounting
+
+**Code to check admin**:
+```javascript
+const ADMIN_SLOT = '0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103';
+const admin = await provider.getStorageAt(LFT_TOKEN, ADMIN_SLOT);
+console.log('Proxy Admin:', '0x' + admin.slice(-40));
+```
+
+---
+
+## Exploit 5: Social Engineering
+
+**Objective**: Get scammer to make mistake
+
+**Method**:
+1. Create fake "whale buyer" persona
+2. Contact scammer offering to buy large amount
+3. Request they move tokens to specific address
+4. When they move tokens, front-run or exploit
+
+**Risks**:
+- Requires social engineering skills
+- Scammer may be sophisticated
+- May not work
+
+---
+
+## Recommended Attack Strategy
+
+### Phase 1: Intelligence Gathering
+
+1. **Monitor hidden address** continuously
+2. **Track minter activity** for new mints
+3. **Watch Uniswap pools** for liquidity changes
+4. **Analyze transaction patterns** from scammer addresses
+
+### Phase 2: Community Alert
+
+1. **Share this analysis** on social media
+2. **Warn exchanges** to delist LFT
+3. **Alert DeFi protocols** to blacklist LFT
+4. **Educate users** about the scam
+
+### Phase 3: Front-Running Preparation
+
+1. **Set up MEV bot** to monitor pending transactions
+2. **Prepare sell transactions** with high gas
+3. **Monitor mempool** for dump attempts
+4. **Execute front-run** when dump detected
+
+### Phase 4: Legal Action
+
+1. **Report to authorities** (SEC, FBI, local police)
+2. **Gather evidence** (on-chain transactions, decompiled code)
+3. **Identify scammer** (trace addresses, exchanges, IPs)
+4. **Pursue legal action** for fraud
+
+---
+
+## Limitations
+
+### What We CANNOT Do
+
+1. **Cannot steal hidden tokens** (don't have private key)
+2. **Cannot change minter** (owner is renounced)
+3. **Cannot upgrade contract** (if admin is renounced)
+4. **Cannot force burn** (no burn function for others)
+
+### What We CAN Do
+
+1. ✅ **Monitor hidden balance** in real-time
+2. ✅ **Front-run dump attempts** with MEV
+3. ✅ **Alert community** before dump
+4. ✅ **Track scammer addresses**
+5. ✅ **Report to authorities**
+6. ✅ **Educate users** about scam
+
+---
+
+## Economic Analysis
+
+### Scammer's Position
+
+```
+Hidden Balance: 4,999,999,404,930,372 LFT
+Current Price: ~$0.0001 per LFT (estimated)
+Potential Value: ~$500M (if they could dump all)
+Realistic Value: ~$1-10M (due to slippage)
+```
+
+### Our Position
+
+```
+If we hold LFT: SELL IMMEDIATELY
+If we can front-run: Profit from dump
+If we alert community: Reduce scammer profit
+```
+
+### Best Case Scenario
+
+1. We detect dump attempt early
+2. Front-run with our own sell
+3. Extract maximum value
+4. Price crashes
+5. Scammer gets minimal profit
+6. Community is warned
+7. Token dies
+8. Scammer is identified and prosecuted
+
+---
+
+## Proof of Concept: Front-Running Bot
+
+```solidity
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+interface IERC20 {
+    function balanceOf(address) external view returns (uint256);
+    function transfer(address, uint256) external returns (bool);
+    function approve(address, uint256) external returns (bool);
+}
+
+interface IUniswapV2Router {
+    function swapExactTokensForETH(
+        uint amountIn,
+        uint amountOutMin,
+        address[] calldata path,
+        address to,
+        uint deadline
+    ) external returns (uint[] memory amounts);
+}
+
+contract LFTFrontRunner {
+    address constant LFT = 0xb620be8a1949aa9532e6a3510132864ef9bc3f82;
+    address constant ROUTER = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
+    address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
+    address constant HIDDEN_ADDR = 0x2caa8387030af8fd61c59eee88341dc590883496;
+    
+    address public owner;
+    
+    constructor() {
+        owner = msg.sender;
+    }
+    
+    // Front-run the scammer's dump
+    function frontRunDump(uint256 amountLFT) external {
+        require(msg.sender == owner, "Not owner");
+        
+        // Approve router
+        IERC20(LFT).approve(ROUTER, amountLFT);
+        
+        // Sell LFT for ETH
+        address[] memory path = new address[](2);
+        path[0] = LFT;
+        path[1] = WETH;
+        
+        IUniswapV2Router(ROUTER).swapExactTokensForETH(
+            amountLFT,
+            0, // Accept any amount of ETH
+            path,
+            address(this),
+            block.timestamp + 300
+        );
+        
+        // Send ETH to owner
+        payable(owner).transfer(address(this).balance);
+    }
+    
+    // Emergency withdraw
+    function withdraw() external {
+        require(msg.sender == owner, "Not owner");
+        payable(owner).transfer(address(this).balance);
+        
+        uint256 lftBalance = IERC20(LFT).balanceOf(address(this));
+        if (lftBalance > 0) {
+            IERC20(LFT).transfer(owner, lftBalance);
+        }
+    }
+    
+    receive() external payable {}
+}
+```
+
+---
+
+## Conclusion
+
+While we **cannot directly steal** the hidden tokens, we can:
+
+1. ✅ **Monitor and alert** the community
+2. ✅ **Front-run dump attempts** to extract value first
+3. ✅ **Make dumping unprofitable** through MEV
+4. ✅ **Track and identify** the scammers
+5. ✅ **Report to authorities** for prosecution
+
+The best defense is **awareness and preparation**. By monitoring the hidden address and setting up front-running infrastructure, we can minimize the scammer's profit and protect the community.
+
+---
+
+## Files
+
+- `check-lft-roles.js` - Check current role holders
+- `test-lft-hidden-balance.js` - Monitor hidden balance
+- `LFTFrontRunner.sol` - Front-running contract (above)
+
+---
+
+**Status**: READY TO DEPLOY  
+**Risk**: HIGH (scammer can dump anytime)  
+**Action**: MONITOR AND PREPARE
+
+🚨 **The best revenge is making their scam unprofitable** 🚨