uups-checker 1.0.0

package/PANCAKESWAP_UNDERFLOW_HUNTING.md

@@ -0,0 +1,317 @@
+# PancakeSwap Underflow Hunting Guide
+## Finding Integer Underflow Vulnerabilities via BscScan & Dune
+
+## Google Dorks for BscScan
+
+### 1. Find Contracts with Subtraction Operations
+```
+site:bscscan.com "pragma solidity" "balanceOf" "-=" inurl:address
+site:bscscan.com "pragma solidity" "balance -" "transfer"
+site:bscscan.com intitle:"Contract Source Code" "unchecked" "-"
+```
+
+### 2. Find Old Solidity Versions (Pre-0.8.0)
+```
+site:bscscan.com "pragma solidity ^0.6" "balanceOf"
+site:bscscan.com "pragma solidity 0.7" "transfer" "-="
+site:bscscan.com "pragma solidity ^0.5" "withdraw"
+```
+
+### 3. Find Contracts Without SafeMath
+```
+site:bscscan.com "pragma solidity" "balanceOf" -"SafeMath" -"using"
+site:bscscan.com "transfer" "balance -" -"SafeMath.sub"
+site:bscscan.com "withdraw" "-=" -"require" -"SafeMath"
+```
+
+### 4. Find Specific Vulnerable Patterns
+```
+site:bscscan.com "balances[msg.sender] -= amount" "transfer"
+site:bscscan.com "balance = balance - amount" -"require"
+site:bscscan.com "totalSupply -= amount" -"SafeMath"
+```
+
+### 5. Find PancakeSwap Forks
+```
+site:bscscan.com "PancakeSwap" "pragma solidity ^0.6"
+site:bscscan.com "IPancakeRouter" "balanceOf" "-="
+site:bscscan.com "PancakePair" "burn" "balanceOf"
+```
+
+### 6. Find Staking/Farming Contracts
+```
+site:bscscan.com "stake" "withdraw" "balanceOf" "-=" "pragma solidity ^0.6"
+site:bscscan.com "farm" "harvest" "pending" "-" -"SafeMath"
+site:bscscan.com "MasterChef" "withdraw" "userInfo"
+```
+
+### 7. Find Reward Distribution Bugs
+```
+site:bscscan.com "rewardDebt" "-=" -"SafeMath"
+site:bscscan.com "pendingReward" "balance -" -"require"
+site:bscscan.com "claimReward" "totalRewards -" 
+```
+
+## Dune Analytics Queries
+
+### 1. Find Contracts with Failed Transactions (Potential Underflows)
+```sql
+-- Find contracts with high revert rates
+SELECT 
+    "to" as contract_address,
+    COUNT(*) as total_txs,
+    SUM(CASE WHEN success = false THEN 1 ELSE 0 END) as failed_txs,
+    SUM(CASE WHEN success = false THEN 1 ELSE 0 END) * 100.0 / COUNT(*) as fail_rate
+FROM bsc.transactions
+WHERE block_time > NOW() - INTERVAL '30' DAY
+    AND "to" IS NOT NULL
+GROUP BY "to"
+HAVING SUM(CASE WHEN success = false THEN 1 ELSE 0 END) > 100
+    AND SUM(CASE WHEN success = false THEN 1 ELSE 0 END) * 100.0 / COUNT(*) > 10
+ORDER BY failed_txs DESC
+LIMIT 100;
+```
+
+### 2. Find Contracts with Arithmetic Errors
+```sql
+-- Look for revert reasons containing "underflow" or "overflow"
+SELECT 
+    "to" as contract_address,
+    COUNT(*) as error_count,
+    MAX(block_time) as last_error
+FROM bsc.transactions
+WHERE block_time > NOW() - INTERVAL '90' DAY
+    AND success = false
+    AND (
+        revert_reason LIKE '%underflow%' OR
+        revert_reason LIKE '%overflow%' OR
+        revert_reason LIKE '%SafeMath%' OR
+        revert_reason LIKE '%arithmetic%'
+    )
+GROUP BY "to"
+ORDER BY error_count DESC
+LIMIT 50;
+```
+
+### 3. Find Suspicious Balance Changes
+```sql
+-- Find contracts with negative balance changes (impossible without underflow)
+SELECT 
+    contract_address,
+    token_address,
+    SUM(amount) as net_change,
+    COUNT(*) as transfer_count
+FROM bsc.erc20_transfers
+WHERE block_time > NOW() - INTERVAL '7' DAY
+GROUP BY contract_address, token_address
+HAVING SUM(amount) < 0
+ORDER BY net_change ASC
+LIMIT 100;
+```
+
+### 4. Find High-Value Contracts with Old Solidity
+```sql
+-- Find valuable contracts that might use old Solidity
+SELECT 
+    t.contract_address,
+    SUM(t.value) as total_value_locked,
+    COUNT(DISTINCT t.from) as unique_users,
+    MAX(t.block_time) as last_activity
+FROM bsc.erc20_transfers t
+WHERE t.block_time > NOW() - INTERVAL '30' DAY
+GROUP BY t.contract_address
+HAVING SUM(t.value) > 1000000 -- $1M+ TVL
+ORDER BY total_value_locked DESC
+LIMIT 100;
+```
+
+### 5. Find Contracts with Withdrawal Patterns
+```sql
+-- Find contracts where withdrawals exceed deposits (red flag)
+WITH deposits AS (
+    SELECT 
+        "to" as contract_address,
+        SUM(value) as total_deposits
+    FROM bsc.erc20_transfers
+    WHERE block_time > NOW() - INTERVAL '30' DAY
+    GROUP BY "to"
+),
+withdrawals AS (
+    SELECT 
+        "from" as contract_address,
+        SUM(value) as total_withdrawals
+    FROM bsc.erc20_transfers
+    WHERE block_time > NOW() - INTERVAL '30' DAY
+    GROUP BY "from"
+)
+SELECT 
+    d.contract_address,
+    d.total_deposits,
+    w.total_withdrawals,
+    w.total_withdrawals - d.total_deposits as net_outflow
+FROM deposits d
+JOIN withdrawals w ON d.contract_address = w.contract_address
+WHERE w.total_withdrawals > d.total_deposits * 1.1
+ORDER BY net_outflow DESC
+LIMIT 50;
+```
+
+## Advanced Search Techniques
+
+### GitHub Code Search
+```
+org:pancakeswap-org "pragma solidity ^0.6" "balanceOf" "-="
+org:pancakeswap-org "withdraw" "balance -" -"SafeMath"
+language:solidity "PancakeRouter" "balanceOf" "-=" -"SafeMath"
+```
+
+### BscScan API Queries
+```bash
+# Get verified contracts
+curl "https://api.bscscan.com/api?module=contract&action=getcontractcreation&contractaddresses=ADDRESS"
+
+# Get source code
+curl "https://api.bscscan.com/api?module=contract&action=getsourcecode&address=ADDRESS"
+```
+
+## Vulnerability Patterns to Look For
+
+### 1. Classic Underflow
+```solidity
+// VULNERABLE (Solidity <0.8.0)
+function withdraw(uint256 amount) external {
+    balances[msg.sender] -= amount;  // Can underflow!
+    token.transfer(msg.sender, amount);
+}
+```
+
+### 2. Reward Calculation Underflow
+```solidity
+// VULNERABLE
+function claimReward() external {
+    uint256 pending = calculatePending(msg.sender);
+    rewardDebt[msg.sender] -= pending;  // Can underflow!
+    rewardToken.transfer(msg.sender, pending);
+}
+```
+
+### 3. Total Supply Underflow
+```solidity
+// VULNERABLE
+function burn(uint256 amount) external {
+    balances[msg.sender] -= amount;
+    totalSupply -= amount;  // Can underflow if balances wrong!
+}
+```
+
+### 4. Time-Based Calculation Underflow
+```solidity
+// VULNERABLE
+function calculateReward(address user) public view returns (uint256) {
+    uint256 duration = block.timestamp - lastClaim[user];  // Can underflow!
+    return duration * rewardRate;
+}
+```
+
+## Automated Scanning Tools
+
+### 1. Slither
+```bash
+slither contract.sol --detect integer-overflow
+slither contract.sol --detect unchecked-lowlevel
+```
+
+### 2. Mythril
+```bash
+myth analyze contract.sol --execution-timeout 300
+```
+
+### 3. Custom Script
+```javascript
+// Scan BscScan for vulnerable patterns
+const axios = require('axios');
+
+async function scanContract(address) {
+    const response = await axios.get(
+        `https://api.bscscan.com/api?module=contract&action=getsourcecode&address=${address}`
+    );
+    
+    const source = response.data.result[0].SourceCode;
+    const compiler = response.data.result[0].CompilerVersion;
+    
+    // Check for old Solidity
+    if (compiler.includes('0.6') || compiler.includes('0.7')) {
+        // Check for unsafe operations
+        if (source.includes('-=') && !source.includes('SafeMath')) {
+            console.log(`⚠️  Potential underflow in ${address}`);
+        }
+    }
+}
+```
+
+## Real-World Examples
+
+### 1. XFI Staking Underflow (From Your Audits)
+```
+Contract: XFI Staking
+Issue: Reward calculation underflow
+Pattern: rewardDebt -= pending without SafeMath
+```
+
+### 2. Common PancakeSwap Fork Issues
+```
+Contract: MasterChef clones
+Issue: userInfo.rewardDebt underflow
+Pattern: user.rewardDebt = user.rewardDebt.sub(pending)
+```
+
+## Best Google Dork Combinations
+
+### For Maximum Results:
+```
+site:bscscan.com "pragma solidity ^0.6" ("balanceOf" | "withdraw") "-=" -"SafeMath" inurl:address
+
+site:bscscan.com ("MasterChef" | "PancakeSwap") "pragma solidity" "rewardDebt" "-="
+
+site:bscscan.com "pragma solidity 0.6" "function withdraw" "balances[" "-=" -"require"
+
+site:bscscan.com intitle:"Contract Source Code" "totalSupply -=" -"SafeMath" -"0.8"
+```
+
+## Dune Dashboard Template
+
+Create a dashboard with:
+1. **Failed Transaction Monitor** - Track contracts with high revert rates
+2. **Balance Anomaly Detector** - Find impossible balance changes
+3. **Old Solidity Tracker** - Monitor high-TVL contracts with old compilers
+4. **Withdrawal Pattern Analyzer** - Detect suspicious outflows
+
+## Pro Tips
+
+1. **Focus on High TVL** - Prioritize contracts with >$100k locked
+2. **Check Compiler Version** - Solidity <0.8.0 is vulnerable
+3. **Look for Forks** - PancakeSwap forks often copy bugs
+4. **Monitor New Deployments** - Fresh contracts may have bugs
+5. **Check Audit Status** - Unaudited = higher risk
+6. **Test on Testnet** - Verify exploits safely first
+
+## Ethical Considerations
+
+⚠️ **IMPORTANT:**
+- Only test on testnets or with permission
+- Report vulnerabilities responsibly
+- Don't exploit live contracts
+- Follow bug bounty programs
+- Respect white-hat ethics
+
+## Resources
+
+- BscScan: https://bscscan.com
+- Dune Analytics: https://dune.com
+- PancakeSwap Docs: https://docs.pancakeswap.finance
+- Solidity Docs: https://docs.soliditylang.org
+- OpenZeppelin: https://docs.openzeppelin.com
+
+---
+
+**Remember:** Finding vulnerabilities is for security research and responsible disclosure, not exploitation!