uups-checker 1.0.0

package/check-nora-lock.js

@@ -0,0 +1,67 @@
+const ethers = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://bsc-dataseed.binance.org/');
+
+async function checkLock() {
+    const lockAddress = '0x7536592bb74b5d62eb82e8b93b17eed4eed9a85c';
+    const noraToken = '0x1f39dd2bf5a27e2d4ed691dcf933077371777cb0';
+    
+    // Get bytecode
+    const code = await provider.getCode(lockAddress);
+    console.log('Lock contract bytecode length:', code.length);
+    
+    // Check if it's verified
+    console.log('\nContract Address:', lockAddress);
+    console.log('Checking token balance in lock...\n');
+    
+    const tokenContract = new ethers.Contract(noraToken, [
+        'function balanceOf(address) view returns (uint256)',
+        'function decimals() view returns (uint8)'
+    ], provider);
+    
+    const balance = await tokenContract.balanceOf(lockAddress);
+    const decimals = await tokenContract.decimals();
+    
+    console.log('NORA tokens locked:', ethers.utils.formatUnits(balance, decimals));
+    console.log('Raw balance:', balance.toString());
+    
+    // Try to call common lock contract functions
+    const lockContract = new ethers.Contract(lockAddress, [
+        'function withdrawTokens(address) external',
+        'function token() view returns (address)',
+        'function beneficiary() view returns (address)',
+        'function releaseTime() view returns (uint256)',
+        'function owner() view returns (address)'
+    ], provider);
+    
+    try {
+        const token = await lockContract.token();
+        console.log('\nLocked token:', token);
+    } catch (e) {
+        console.log('\nNo token() function');
+    }
+    
+    try {
+        const beneficiary = await lockContract.beneficiary();
+        console.log('Beneficiary:', beneficiary);
+    } catch (e) {
+        console.log('No beneficiary() function');
+    }
+    
+    try {
+        const releaseTime = await lockContract.releaseTime();
+        const date = new Date(releaseTime.toNumber() * 1000);
+        console.log('Release time:', releaseTime.toString(), '(' + date.toISOString() + ')');
+    } catch (e) {
+        console.log('No releaseTime() function');
+    }
+    
+    try {
+        const owner = await lockContract.owner();
+        console.log('Owner:', owner);
+    } catch (e) {
+        console.log('No owner() function');
+    }
+}
+
+checkLock().catch(console.error);

package/check-oiler-approvals.js

@@ -0,0 +1,116 @@
+const { ethers } = require('ethers');
+
+// Setup provider
+const provider = new ethers.providers.JsonRpcProvider('https://eth-mainnet.g.alchemy.com/v2/5IWkkFu-rS6plYHO9MLq-');
+
+// Addresses
+const OIL_TOKEN = '0x0275E1001e293C46CFe158B3702AADe0B99f88a5';
+const PROXY = '0xA94db69502920A657F8685978e62D3E3B9762adf';
+
+async function checkApprovals() {
+    console.log('=== CHECKING ALL OIL APPROVALS FROM PROXY ===\n');
+    console.log(`Proxy: ${PROXY}`);
+    console.log(`OIL Token: ${OIL_TOKEN}\n`);
+    
+    try {
+        // Get all Approval events where owner = PROXY
+        const approvalTopic = ethers.utils.id('Approval(address,address,uint256)');
+        const proxyTopic = ethers.utils.hexZeroPad(PROXY.toLowerCase(), 32);
+        
+        console.log('Fetching approval events from blockchain...\n');
+        
+        // Get events in chunks (last 10000 blocks at a time)
+        const currentBlock = await provider.getBlockNumber();
+        const startBlock = currentBlock - 100000; // Last ~100k blocks
+        
+        const filter = {
+            address: OIL_TOKEN,
+            topics: [
+                approvalTopic,
+                proxyTopic  // owner = PROXY
+            ],
+            fromBlock: startBlock,
+            toBlock: 'latest'
+        };
+        
+        const logs = await provider.getLogs(filter);
+        
+        console.log(`Found ${logs.length} approval events\n`);
+        
+        if (logs.length === 0) {
+            console.log('No recent approval events found.');
+            console.log('The proxy may have never approved OIL to any contract,');
+            console.log('or approvals happened more than 100k blocks ago.\n');
+        }
+        
+        // Parse and display approvals
+        const ERC20_ABI = ['event Approval(address indexed owner, address indexed spender, uint256 value)'];
+        const iface = new ethers.utils.Interface(ERC20_ABI);
+        
+        const approvals = new Map();
+        
+        for (const log of logs) {
+            const parsed = iface.parseLog(log);
+            const spender = parsed.args.spender;
+            const value = parsed.args.value;
+            
+            // Keep only the latest approval for each spender
+            approvals.set(spender, value);
+        }
+        
+        console.log('=== CURRENT APPROVALS ===\n');
+        
+        let hasActiveApprovals = false;
+        
+        for (const [spender, value] of approvals.entries()) {
+            const valueFormatted = ethers.utils.formatUnits(value, 18);
+            
+            if (!value.eq(0)) {
+                hasActiveApprovals = true;
+                console.log(`🚨 ACTIVE APPROVAL:`);
+                console.log(`   Spender: ${spender}`);
+                console.log(`   Amount: ${valueFormatted} OIL`);
+                console.log(`   Raw: ${value.toString()}\n`);
+            } else {
+                console.log(`✅ Revoked approval to: ${spender}\n`);
+            }
+        }
+        
+        if (!hasActiveApprovals && approvals.size > 0) {
+            console.log('\n✅ All approvals have been revoked (set to 0)');
+            console.log('The proxy is SAFE from approval-based attacks.\n');
+        } else if (!hasActiveApprovals && approvals.size === 0) {
+            console.log('No approval events found in recent history.\n');
+        }
+        
+        // Now check specific common contracts
+        console.log('\n=== CHECKING SPECIFIC CONTRACTS ===\n');
+        
+        const contractsToCheck = [
+            { name: 'Uniswap V2 Router', address: '0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D' },
+            { name: 'Uniswap V3 Router', address: '0xE592427A0AEce92De3Edee1F18E0157C05861564' },
+            { name: 'Uniswap V3 Router 2', address: '0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45' },
+        ];
+        
+        const ERC20_ABI_CHECK = ['function allowance(address owner, address spender) view returns (uint256)'];
+        const oilToken = new ethers.Contract(OIL_TOKEN, ERC20_ABI_CHECK, provider);
+        
+        for (const contract of contractsToCheck) {
+            const allowance = await oilToken.allowance(PROXY, contract.address);
+            const allowanceFormatted = ethers.utils.formatUnits(allowance, 18);
+            
+            if (allowance.gt(0)) {
+                console.log(`🚨 ${contract.name}:`);
+                console.log(`   Address: ${contract.address}`);
+                console.log(`   Allowance: ${allowanceFormatted} OIL\n`);
+            } else {
+                console.log(`✅ ${contract.name}: No approval\n`);
+            }
+        }
+        
+    } catch (error) {
+        console.error('Error:', error.message);
+    }
+}
+
+checkApprovals();

package/check-oiler-proxy.js

@@ -0,0 +1,73 @@
+const { ethers } = require('ethers');
+
+// Setup provider (ethers v5 syntax)
+const provider = new ethers.providers.JsonRpcProvider('https://eth-mainnet.g.alchemy.com/v2/5IWkkFu-rS6plYHO9MLq-');
+
+// Addresses
+const OIL_TOKEN = '0x0275E1001e293C46CFe158B3702AADe0B99f88a5';
+const PROXY = '0xA94db69502920A657F8685978e62D3E3B9762adf';
+const UNISWAP_ROUTER = '0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D';
+
+// ERC20 ABI (minimal)
+const ERC20_ABI = [
+    'function balanceOf(address) view returns (uint256)',
+    'function allowance(address owner, address spender) view returns (uint256)',
+    'function decimals() view returns (uint8)'
+];
+
+async function checkProxyState() {
+    console.log('=== OILER LP PROXY ANALYSIS ===\n');
+    
+    const oilToken = new ethers.Contract(OIL_TOKEN, ERC20_ABI, provider);
+    
+    try {
+        // Get proxy's OIL balance
+        const balance = await oilToken.balanceOf(PROXY);
+        const decimals = await oilToken.decimals();
+        const balanceFormatted = ethers.utils.formatUnits(balance, decimals);
+        
+        console.log(`Proxy Address: ${PROXY}`);
+        console.log(`OIL Token: ${OIL_TOKEN}`);
+        console.log(`\nProxy OIL Balance: ${balance.toString()} (${balanceFormatted} OIL)`);
+        
+        // Get proxy's approval to Uniswap Router
+        const approval = await oilToken.allowance(PROXY, UNISWAP_ROUTER);
+        const approvalFormatted = ethers.utils.formatUnits(approval, decimals);
+        
+        console.log(`\nApproval to Uniswap Router: ${approval.toString()} (${approvalFormatted} OIL)`);
+        console.log(`Router Address: ${UNISWAP_ROUTER}`);
+        
+        // Analysis
+        console.log('\n=== VULNERABILITY ANALYSIS ===');
+        
+        if (approval.gt(0) && balance.gt(0)) {
+            const maxSteal = approval.lt(balance) ? approval : balance;
+            const maxStealFormatted = ethers.utils.formatUnits(maxSteal, decimals);
+            
+            console.log(`\n🚨 CRITICALLY VULNERABLE!`);
+            console.log(`\nThe proxy has approved ${approvalFormatted} OIL to the Uniswap Router.`);
+            console.log(`Combined with the OIL token's transferAndCall reentrancy bug,`);
+            console.log(`an attacker can steal up to ${maxStealFormatted} OIL tokens!`);
+            console.log(`\nATTACK VECTOR:`);
+            console.log(`1. Call OIL.transferAndCall() to trigger callback`);
+            console.log(`2. During callback, call OIL.transferFrom(PROXY, attacker, amount)`);
+            console.log(`3. The approval allows transferFrom to succeed`);
+            console.log(`4. Steal ${maxStealFormatted} OIL tokens`);
+            
+            // Calculate USD value (approximate)
+            console.log(`\n💰 POTENTIAL LOSS: ~${maxStealFormatted} OIL tokens`);
+            
+        } else if (approval.eq(0)) {
+            console.log(`\n✅ SAFE: Proxy has no approval to Router`);
+            console.log(`The proxy cannot be exploited via this attack vector.`);
+        } else if (balance.eq(0)) {
+            console.log(`\n✅ SAFE: Proxy has no OIL balance`);
+            console.log(`Nothing to steal.`);
+        }
+        
+    } catch (error) {
+        console.error('Error:', error.message);
+    }
+}
+
+checkProxyState();

package/check-oiler-staking.js

@@ -0,0 +1,117 @@
+const { ethers } = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://eth-mainnet.g.alchemy.com/v2/5IWkkFu-rS6plYHO9MLq-');
+
+const OIL_TOKEN = '0x0275E1001e293C46CFe158B3702AADe0B99f88a5';
+const STAKING_CONTRACT = '0xe546f8f17aff17c05dac9f9b4f9957f725fab087';
+const OIL_USDC_LP = '0x0e9c8107682ab88604b4fbf847eeeceacf38e9e6'; // Uniswap V2 OIL-USDC pair
+
+const ERC20_ABI = [
+    'function balanceOf(address) view returns (uint256)',
+    'function allowance(address owner, address spender) view returns (uint256)',
+    'function decimals() view returns (uint8)',
+    'function symbol() view returns (string)',
+    'function name() view returns (string)'
+];
+
+async function checkStaking() {
+    console.log('=== OILER STAKING CONTRACT ANALYSIS ===\n');
+    console.log(`Staking Contract: ${STAKING_CONTRACT}\n`);
+    
+    const oilToken = new ethers.Contract(OIL_TOKEN, ERC20_ABI, provider);
+    const lpToken = new ethers.Contract(OIL_USDC_LP, ERC20_ABI, provider);
+    
+    // Check OIL balance
+    const oilBalance = await oilToken.balanceOf(STAKING_CONTRACT);
+    const oilDecimals = await oilToken.decimals();
+    const oilBalanceFormatted = ethers.utils.formatUnits(oilBalance, oilDecimals);
+    
+    console.log('=== TOKEN BALANCES ===');
+    console.log(`OIL Balance: ${oilBalanceFormatted} OIL`);
+    
+    // Check LP token balance
+    const lpBalance = await lpToken.balanceOf(STAKING_CONTRACT);
+    const lpDecimals = await lpToken.decimals();
+    const lpBalanceFormatted = ethers.utils.formatUnits(lpBalance, lpDecimals);
+    
+    console.log(`LP Token Balance: ${lpBalanceFormatted} LP tokens\n`);
+    
+    // Check approvals from staking contract
+    const contractsToCheck = [
+        { name: 'Uniswap V2 Router', address: '0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D' },
+        { name: 'Uniswap V3 Router', address: '0xE592427A0AEce92De3Edee1F18E0157C05861564' },
+        { name: 'SushiSwap Router', address: '0xd9e1cE17f2641f24aE83637ab66a2cca9C378B9F' },
+    ];
+    
+    console.log('=== OIL TOKEN APPROVALS FROM STAKING CONTRACT ===\n');
+    
+    let vulnerableOil = false;
+    
+    for (const contract of contractsToCheck) {
+        const allowance = await oilToken.allowance(STAKING_CONTRACT, contract.address);
+        const allowanceFormatted = ethers.utils.formatUnits(allowance, oilDecimals);
+        
+        if (allowance.gt(0)) {
+            console.log(`🚨 VULNERABLE!`);
+            console.log(`   Contract: ${contract.name}`);
+            console.log(`   Address: ${contract.address}`);
+            console.log(`   OIL Allowance: ${allowanceFormatted} OIL\n`);
+            vulnerableOil = true;
+        } else {
+            console.log(`✅ ${contract.name}: No OIL approval`);
+        }
+    }
+    
+    console.log('\n=== LP TOKEN APPROVALS FROM STAKING CONTRACT ===\n');
+    
+    let vulnerableLp = false;
+    
+    for (const contract of contractsToCheck) {
+        const allowance = await lpToken.allowance(STAKING_CONTRACT, contract.address);
+        const allowanceFormatted = ethers.utils.formatUnits(allowance, lpDecimals);
+        
+        if (allowance.gt(0)) {
+            console.log(`🚨 LP APPROVAL FOUND!`);
+            console.log(`   Contract: ${contract.name}`);
+            console.log(`   Address: ${contract.address}`);
+            console.log(`   LP Allowance: ${allowanceFormatted} LP\n`);
+            vulnerableLp = true;
+        } else {
+            console.log(`✅ ${contract.name}: No LP approval`);
+        }
+    }
+    
+    // Get contract bytecode to check if it's verified
+    const code = await provider.getCode(STAKING_CONTRACT);
+    console.log(`\n=== CONTRACT INFO ===`);
+    console.log(`Bytecode length: ${code.length} bytes`);
+    console.log(`Contract is deployed: ${code !== '0x'}`);
+    
+    console.log('\n=== VULNERABILITY ASSESSMENT ===\n');
+    
+    if (vulnerableOil) {
+        console.log('🚨 CRITICALLY VULNERABLE!');
+        console.log('The staking contract has approved OIL to external contracts.');
+        console.log('Combined with OIL token\'s transferAndCall reentrancy bug,');
+        console.log('an attacker can drain the approved OIL tokens!\n');
+        console.log('ATTACK VECTOR:');
+        console.log('1. Call OIL.transferAndCall() to trigger callback');
+        console.log('2. During callback, call OIL.transferFrom(STAKING, attacker, amount)');
+        console.log('3. Steal all approved OIL tokens\n');
+    } else if (vulnerableLp) {
+        console.log('⚠️  LP tokens are approved but OIL is not.');
+        console.log('LP tokens themselves don\'t have transferAndCall,');
+        console.log('so direct reentrancy attack may not work.\n');
+    } else {
+        console.log('✅ NO ACTIVE APPROVALS FOUND');
+        console.log('The staking contract appears safe from approval-based attacks.');
+        console.log('However, check the contract source code for other vulnerabilities.\n');
+    }
+    
+    // Summary
+    console.log('=== SUMMARY ===');
+    console.log(`Total OIL at risk: ${vulnerableOil ? oilBalanceFormatted : '0'} OIL`);
+    console.log(`Total LP at risk: ${vulnerableLp ? lpBalanceFormatted : '0'} LP`);
+}
+
+checkStaking().catch(console.error);

package/check-proxy-simple.js

@@ -0,0 +1,71 @@
+const { ethers } = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://eth-mainnet.g.alchemy.com/v2/5IWkkFu-rS6plYHO9MLq-');
+
+const OIL_TOKEN = '0x0275E1001e293C46CFe158B3702AADe0B99f88a5';
+const PROXY = '0xA94db69502920A657F8685978e62D3E3B9762adf';
+
+const ERC20_ABI = [
+    'function balanceOf(address) view returns (uint256)',
+    'function allowance(address owner, address spender) view returns (uint256)',
+    'function decimals() view returns (uint8)'
+];
+
+async function checkProxy() {
+    console.log('=== OILER LP PROXY VULNERABILITY CHECK ===\n');
+    
+    const oilToken = new ethers.Contract(OIL_TOKEN, ERC20_ABI, provider);
+    
+    // Get balance
+    const balance = await oilToken.balanceOf(PROXY);
+    const decimals = await oilToken.decimals();
+    const balanceFormatted = ethers.utils.formatUnits(balance, decimals);
+    
+    console.log(`Proxy: ${PROXY}`);
+    console.log(`OIL Balance: ${balanceFormatted} OIL\n`);
+    
+    // Check common contracts
+    const contractsToCheck = [
+        { name: 'Uniswap V2 Router', address: '0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D' },
+        { name: 'Uniswap V3 Router', address: '0xE592427A0AEce92De3Edee1F18E0157C05861564' },
+        { name: 'Uniswap V3 Router 2', address: '0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45' },
+        { name: 'SushiSwap Router', address: '0xd9e1cE17f2641f24aE83637ab66a2cca9C378B9F' },
+        { name: '1inch Router V5', address: '0x1111111254EEB25477B68fb85Ed929f73A960582' },
+    ];
+    
+    console.log('=== CHECKING APPROVALS ===\n');
+    
+    let vulnerable = false;
+    
+    for (const contract of contractsToCheck) {
+        const allowance = await oilToken.allowance(PROXY, contract.address);
+        const allowanceFormatted = ethers.utils.formatUnits(allowance, decimals);
+        
+        if (allowance.gt(0)) {
+            console.log(`🚨 VULNERABLE!`);
+            console.log(`   Contract: ${contract.name}`);
+            console.log(`   Address: ${contract.address}`);
+            console.log(`   Allowance: ${allowanceFormatted} OIL`);
+            console.log(`   Can steal: ${allowanceFormatted} OIL via reentrancy\n`);
+            vulnerable = true;
+        } else {
+            console.log(`✅ ${contract.name}: No approval`);
+        }
+    }
+    
+    console.log('\n=== CONCLUSION ===\n');
+    
+    if (vulnerable) {
+        console.log('🚨 PROXY IS VULNERABLE TO REENTRANCY ATTACK!');
+        console.log('The OIL token has a transferAndCall reentrancy bug.');
+        console.log('An attacker can steal approved tokens during the callback.\n');
+    } else {
+        console.log('✅ PROXY IS CURRENTLY SAFE');
+        console.log('No active approvals found to common DEX routers.');
+        console.log('The proxy cannot be exploited via this attack vector.\n');
+        console.log('NOTE: The proxy may have approved other contracts not checked here.');
+        console.log('To be 100% certain, you would need to scan all historical Approval events.\n');
+    }
+}
+
+checkProxy().catch(console.error);

package/check-recent-stakes.js

@@ -0,0 +1,54 @@
+const { ethers } = require('ethers');
+
+const RPC = 'https://bsc-mainnet.infura.io/v3/db4d2c885bc946b691dbb3d5ef26d9e2';
+const STAKING = '0x3E13019dA3BAAd134493e751704D2D4245Eec7CA';
+
+// Staked event signature
+const STAKED_EVENT = '0x9cfd25589d1eb8ad71e342a86a8524e83522e3936c0803048c08f6d9ad974f40';
+
+// Also check for unstake events
+const UNSTAKE_EVENT = '0x'; // We'll check all events
+
+async function main() {
+    const provider = new ethers.providers.JsonRpcProvider(RPC);
+    
+    const latestBlock = await provider.getBlockNumber();
+    console.log('Latest block:', latestBlock);
+    console.log('Checking last 5000 blocks for any events...\n');
+    
+    // Check in smaller chunks
+    const chunkSize = 500;
+    for (let i = 0; i < 10; i++) {
+        const fromBlock = latestBlock - (i + 1) * chunkSize;
+        const toBlock = latestBlock - i * chunkSize;
+        
+        try {
+            const logs = await provider.getLogs({
+                address: STAKING,
+                fromBlock,
+                toBlock
+            });
+            
+            if (logs.length > 0) {
+                console.log(`Found ${logs.length} events in blocks ${fromBlock}-${toBlock}`);
+                console.log('Most recent event:');
+                const log = logs[logs.length - 1];
+                console.log('Block:', log.blockNumber);
+                console.log('Tx:', log.transactionHash);
+                console.log('Topics:', log.topics);
+                
+                const block = await provider.getBlock(log.blockNumber);
+                const date = new Date(block.timestamp * 1000);
+                console.log('Date:', date.toISOString());
+                return;
+            }
+        } catch (e) {
+            console.log(`Error checking blocks ${fromBlock}-${toBlock}:`, e.message);
+        }
+    }
+    
+    console.log('No recent events found in last 5000 blocks');
+    console.log('Contract might be inactive');
+}
+
+main().catch(console.error);

package/check-shegic-holdings.js

@@ -0,0 +1,67 @@
+const { ethers } = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://eth-mainnet.g.alchemy.com/v2/5IWkkFu-rS6plYHO9MLq-');
+
+const SHEGIC = '0x6859ea44DC8E9A42222Ea1BC38ED74E8c8fe6DC7';
+const HEGIC = '0x584bC13c7D411c00c01A62e8019472dE68768430';
+
+const ERC20_ABI = [
+    'function balanceOf(address) view returns (uint256)',
+    'function totalSupply() view returns (uint256)',
+    'function name() view returns (string)',
+    'function symbol() view returns (string)'
+];
+
+async function checkHoldings() {
+    console.log('=== sHEGIC CONTRACT ANALYSIS ===\n');
+    console.log(`sHEGIC: ${SHEGIC}`);
+    console.log(`HEGIC: ${HEGIC}\n`);
+    
+    // Check ETH balance
+    const ethBalance = await provider.getBalance(SHEGIC);
+    console.log(`ETH Balance: ${ethers.utils.formatEther(ethBalance)} ETH\n`);
+    
+    // Check HEGIC balance
+    const hegicToken = new ethers.Contract(HEGIC, ERC20_ABI, provider);
+    const hegicBalance = await hegicToken.balanceOf(SHEGIC);
+    console.log(`HEGIC Balance: ${ethers.utils.formatUnits(hegicBalance, 18)} HEGIC\n`);
+    
+    // Check sHEGIC total supply
+    const shegicToken = new ethers.Contract(SHEGIC, ERC20_ABI, provider);
+    const totalSupply = await shegicToken.totalSupply();
+    console.log(`sHEGIC Total Supply: ${ethers.utils.formatUnits(totalSupply, 18)} sHEGIC\n`);
+    
+    // Check recent transactions
+    console.log('=== CHECKING FOR VALUE ===\n');
+    
+    if (ethBalance.eq(0) && hegicBalance.eq(0)) {
+        console.log('❌ NO FUNDS TO EXPLOIT');
+        console.log('The contract holds no ETH and no HEGIC tokens.');
+        console.log('Even if vulnerabilities exist, there is nothing to steal.\n');
+    } else {
+        console.log('✅ FUNDS DETECTED');
+        console.log(`Total Value: ${ethers.utils.formatEther(ethBalance)} ETH + ${ethers.utils.formatUnits(hegicBalance, 18)} HEGIC\n`);
+    }
+    
+    // Check if contract is active
+    const code = await provider.getCode(SHEGIC);
+    console.log(`Contract Size: ${code.length} bytes`);
+    console.log(`Contract Active: ${code !== '0x'}\n`);
+    
+    console.log('=== VULNERABILITY ASSESSMENT ===\n');
+    console.log('Mythril found:');
+    console.log('- 2x Integer Overflow (name/symbol) - View functions only');
+    console.log('- 2x Timestamp Dependence (withdraw/transfer) - Requires funds');
+    console.log('- 3x Assertion Violations - Logic errors\n');
+    
+    console.log('EXPLOIT POTENTIAL:');
+    if (ethBalance.eq(0) && hegicBalance.eq(0)) {
+        console.log('❌ CANNOT EXPLOIT - No funds in contract');
+        console.log('The vulnerabilities are real but there is nothing to steal.');
+    } else {
+        console.log('⚠️  POTENTIALLY EXPLOITABLE');
+        console.log('Timestamp manipulation could allow early withdrawals.');
+    }
+}
+
+checkHoldings().catch(console.error);

package/check-snowcrash-ecosystem.js

@@ -0,0 +1,83 @@
+const ethers = require('ethers');
+
+const provider = new ethers.providers.JsonRpcProvider('https://bsc-dataseed.binance.org/');
+
+async function checkEcosystem() {
+    const tokenAddress = '0x1f39dd2bf5a27e2d4ed691dcf933077371777cb0';
+    
+    // PancakeSwap V2 Factory
+    const factoryAddress = '0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73';
+    const factoryAbi = ['function getPair(address,address) view returns (address)'];
+    const factory = new ethers.Contract(factoryAddress, factoryAbi, provider);
+    
+    const wbnb = '0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c';
+    const busd = '0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56';
+    const usdt = '0x55d398326f99059fF775485246999027B3197955';
+    
+    console.log('Checking for LP pairs...\n');
+    
+    // Check NORA-WBNB
+    const pairWBNB = await factory.getPair(tokenAddress, wbnb);
+    console.log('NORA-WBNB pair:', pairWBNB);
+    if (pairWBNB !== ethers.constants.AddressZero) {
+        const pairContract = new ethers.Contract(pairWBNB, [
+            'function getReserves() view returns (uint112,uint112,uint32)',
+            'function token0() view returns (address)',
+            'function token1() view returns (address)'
+        ], provider);
+        
+        const reserves = await pairContract.getReserves();
+        const token0 = await pairContract.token0();
+        const token1 = await pairContract.token1();
+        
+        console.log('  Token0:', token0);
+        console.log('  Token1:', token1);
+        console.log('  Reserve0:', ethers.utils.formatEther(reserves[0]));
+        console.log('  Reserve1:', ethers.utils.formatEther(reserves[1]));
+    }
+    
+    // Check NORA-BUSD
+    const pairBUSD = await factory.getPair(tokenAddress, busd);
+    console.log('\nNORA-BUSD pair:', pairBUSD);
+    if (pairBUSD !== ethers.constants.AddressZero) {
+        const pairContract = new ethers.Contract(pairBUSD, [
+            'function getReserves() view returns (uint112,uint112,uint32)'
+        ], provider);
+        const reserves = await pairContract.getReserves();
+        console.log('  Reserve0:', ethers.utils.formatEther(reserves[0]));
+        console.log('  Reserve1:', ethers.utils.formatEther(reserves[1]));
+    }
+    
+    // Check NORA-USDT
+    const pairUSDT = await factory.getPair(tokenAddress, usdt);
+    console.log('\nNORA-USDT pair:', pairUSDT);
+    if (pairUSDT !== ethers.constants.AddressZero) {
+        const pairContract = new ethers.Contract(pairUSDT, [
+            'function getReserves() view returns (uint112,uint112,uint32)'
+        ], provider);
+        const reserves = await pairContract.getReserves();
+        console.log('  Reserve0:', ethers.utils.formatEther(reserves[0]));
+        console.log('  Reserve1:', ethers.utils.formatEther(reserves[1]));
+    }
+    
+    // Check token distribution
+    console.log('\n--- Token Distribution ---');
+    const token = new ethers.Contract(tokenAddress, [
+        'function balanceOf(address) view returns (uint256)',
+        'function totalSupply() view returns (uint256)'
+    ], provider);
+    
+    const totalSupply = await token.totalSupply();
+    console.log('Total Supply:', ethers.utils.formatEther(totalSupply));
+    
+    // Check deployer balance
+    const deployer = '0xb9486eb11a51492b0af1a1f3248e399c17d89597';
+    const deployerBalance = await token.balanceOf(deployer);
+    console.log('Deployer balance:', ethers.utils.formatEther(deployerBalance));
+    
+    // Check contract balance
+    const contractBalance = await token.balanceOf(tokenAddress);
+    console.log('Contract balance:', ethers.utils.formatEther(contractBalance));
+}
+
+checkEcosystem().catch(console.error);