MrFatoni

javascript:(function(){var scripts=document.getElementsByTagName("script"),regex=/(?<=(\"|\'|\`))\/[a-zA-Z0-9_?&=\/\-\#\.]*(?=(\"|\'|\`))/g;const results=new Set;for(var i=0;i<scripts.length;i++){var t=scripts[i].src;""!=t&&fetch(t).then(function(t){return t.text()}).then(function(t){var e=t.matchAll(regex);for(let r of e)results.add(r[0])}).catch(function(t){console.log("An error occurred: ",t)})}var pageContent=document.documentElement.outerHTML,matches=pageContent.matchAll(regex);for(const match of matches)results.add(match[0]);function writeResults(){results.forEach(function(t){document.write(t+"<br>")})}setTimeout(writeResults,3e3);})();

MrFatoni

Halo, tak jelasin seadanya Y

Penjelasan singkat: ketika _transfer() dikenakan fee untuk kemudian diburn.

1. Ketika pengirim melakukan transfer akan dikenakan fee kurang lebih 4%

2. Sedangkan penerima akan mendapatkan potongan 1% (untuk fee dev).

   Ketika kita mengirim token langsung ke address LP, liquidity token (reserve) kurang dari token balance sehingga Attacker bisa memanggil function skim() dan address LP akan melakukan burn fee yg besar mengakibatkan harga berubah.

Selanjutnya Attacker memanggil function sync() untuk menetapkan harga yg baru.

MrFatoni

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;

import "forge-std/Test.sol";


contract asdadsadsadss is Test {
    WETH9 private constant WETH = WETH9(0xB4FBF271143F4FBf7B91A5ded31805e42b2208d6);

    reflectiveERC20 private constant TKN = reflectiveERC20(0x4F252dBE5FD366b38842Cd500281932746047299);

MrFatoni

halo lagi, kyk kemarin alias acak-acakan, step dan pocong di bawah. bug ini (kyknya) price manipulation, reentrancy dan incorrect flaw/validation

Penjelasan: _transfer() bakal ngejalanin logic ketika kita transfer token.

1. kalau kita ngirim token ke address sendiri dengan value 0 akan menjalankan function releasePush() tapi error “ga ada bonus buat lo” 🤔 (karena isi myPush / angka setan kosong)
2. karena trigger releasePush() butuh angka setan maka kita dapatkan dengan transfer token ke LP, dan diulangi beberapa kali. angka setan bertambah dengan looping transfer ke LP & skim() berulang **
3. sewaktu kita ngirim token ke address liquidpool/LP akan menjalankan kalkulasi bonus & angka setan
4. releasePush() akan ngeburn token dari LP (sesuai angka setan?)

MrFatoni

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;

import "forge-std/Test.sol";


contract asdadsadsadss is Test {
    WETH9 private constant WETH = WETH9(0xB4FBF271143F4FBf7B91A5ded31805e42b2208d6);

    reflectiveERC20 private constant TKN = reflectiveERC20(0x9255590C2e66aBb441A9b19A8c518E12FBD5c4d3);

MrFatoni

Verifying my Blockstack ID is secured with the address 12yo266sRfzb3D3hFkHnA7joKMKwn5xj6x https://explorer.blockstack.org/address/12yo266sRfzb3D3hFkHnA7joKMKwn5xj6x

MrFatoni

Keybase proof

I hereby claim:

• I am mrfatoni on github.
• I am mfaton1 (https://keybase.io/mfaton1) on keybase.
• I have a public key ASAg2zQqf52OOxB9m0qBnWW_TdYLFH8xSjBh8hF9dNLZQAo

To claim this, I am signing this object:

MrFatoni

CVE-2018-7600 | Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' RCE (SA-CORE-2018-002)

Source: https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708

Improved (Ruby) exploit ~ http://github.com/dreadlocked/Drupalgeddon2/ // https://www.exploit-db.com/exploits/44449/

---

Drupal v8.x