{"note": {"noteId": 467, "projectId": 18, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0x698cad09b4293967a5c103c3edcda7da442964e77d153d34e8950b1a68413e4a", "content": "{\"action\":\"added\",\"credit\":\"Kept by SunWeb3Sec (github.com/SunWeb3Sec/DeFiHackLabs), Apache-2.0.\",\"day\":\"2026-10-09\",\"kind\":\"watch-hack\",\"lost\":\"Lost: 7.477952467865157795 WETH and 43,855.902196275763910451 VISTA taken from the VISTA/WETH pair on Ethereum, both asserted to the wei on the attacker EOA and as the pair's loss. The attacker later sold 7.46802069 ETH for 18,590.71646 USDC, which is the reported ~$18.6K, and burned the VISTA; that sale is a later transaction and is not part of this PoC. The PoC forks at block 26152249, one block before setRouter, deploys a fresh router, and repeats the privileged call: routerSetter 0xCA90D843288E35beeADfCe14E5F906e3F1AFc7cB calls setRouter on that contract, the same call it sent to 0x469424b628a9d2036e41496e814Db500D683b120 in tx 0xc97ad886a4cbd022edc33deaa44656d66814fe3df1142d03802c96ce7632cc7a at block 26152250. The on-chain router is not impersonated, and the EOA's later VISTA approval of it is not used; the EOA transfers 1 wei of its own VISTA to the fresh router. That router then runs both swaps on the live pair. Swap 1 pulls 21.365578479614736555 WETH, the output the wrapped product allows, and the true uint256 product falls. The donation, sync, and second swap use the trace amounts.\",\"name\":\"EtherVista\",\"path\":\"src/test/2026-10/EtherVista_exp.sol\",\"receipts\":[{\"label\":\"The commit\",\"url\":\"https://github.com/SunWeb3Sec/DeFiHackLabs/commit/b80744e6c0ec1b36a36d90961b6e30c2a313f1e3\"},{\"label\":\"Replay file\",\"url\":\"https://github.com/SunWeb3Sec/DeFiHackLabs/blob/e6a9d80a61a88672acb5c2ce979522ed79246ea0/src/test/2026-10/EtherVista_exp.sol\"},{\"label\":\"README section\",\"url\":\"https://github.com/SunWeb3Sec/DeFiHackLabs/blob/e6a9d80a61a88672acb5c2ce979522ed79246ea0/README.md#20261009-ethervista-ethervistapair-swap-multiplies-its-two-uint112-reserves-inside-the-k-check-so-on-solidity-0-5-16-the-product-wraps-modulo-2-to-the-112-and-the-check-passes-after-the-real-reserve-product-has-fallen-swap-accepts-only-factory-router-the-routersetter-had-just-pointed-that-router-at-the-attacker-s-contract-and-the-contract-paid-1-wei-of-vista-for-21-365578479614736555-weth-then-after-a-permissionless-sync-swapped-4-860669107788601981-weth-of-that-haul-for-43855-902196275763910452-vista\"}],\"recordedAt\":\"2026-11-13T03:10:48Z\",\"sourceId\":\"defihacklabs\",\"text\":\"DeFiHackLabs added a replay of the EtherVista attack from October 9, 2026. The replay is a test anyone can run to see how it worked. Their notes say: Lost: 7.477952467865157795 WETH and 43,855.902196275763910451 VISTA taken from the VISTA/WETH pair on Ethereum, both asserted to the wei on the attacker EOA and as the pair's loss. The attacker later sold 7.46802069 ETH for 18,590.71646 USDC, which is the reported ~$18.6K, and burned the VISTA; that sale is a later transaction and is not part of this PoC. The PoC forks at block 26152249, one block before setRouter, deploys a fresh router, and repeats the privileged call: routerSetter 0xCA90D843288E35beeADfCe14E5F906e3F1AFc7cB calls setRouter on that contract, the same call it sent to 0x469424b628a9d2036e41496e814Db500D683b120 in tx 0xc97ad886a4cbd022edc33deaa44656d66814fe3df1142d03802c96ce7632cc7a at block 26152250. The on-chain router is not impersonated, and the EOA's later VISTA approval of it is not used; the EOA transfers 1 wei of its own VISTA to the fresh router. That router then runs both swaps on the live pair. Swap 1 pulls 21.365578479614736555 WETH, the output the wrapped product allows, and the true uint256 product falls. The donation, sync, and second swap use the trace amounts..\",\"v\":1}", "structured": null, "uri": "", "txHash": "0x6d043003279a1633d581ba2787e3796df49db8294eceb7f37f5ec123703e3ec6", "receiptUrl": "https://flare-explorer.flare.network/tx/0x6d043003279a1633d581ba2787e3796df49db8294eceb7f37f5ec123703e3ec6", "blockNumber": 74406301, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"action": "added", "credit": "Kept by SunWeb3Sec (github.com/SunWeb3Sec/DeFiHackLabs), Apache-2.0.", "day": "2026-10-09", "kind": "watch-hack", "lost": "Lost: 7.477952467865157795 WETH and 43,855.902196275763910451 VISTA taken from the VISTA/WETH pair on Ethereum, both asserted to the wei on the attacker EOA and as the pair's loss. The attacker later sold 7.46802069 ETH for 18,590.71646 USDC, which is the reported ~$18.6K, and burned the VISTA; that sale is a later transaction and is not part of this PoC. The PoC forks at block 26152249, one block before setRouter, deploys a fresh router, and repeats the privileged call: routerSetter 0xCA90D843288E35beeADfCe14E5F906e3F1AFc7cB calls setRouter on that contract, the same call it sent to 0x469424b628a9d2036e41496e814Db500D683b120 in tx 0xc97ad886a4cbd022edc33deaa44656d66814fe3df1142d03802c96ce7632cc7a at block 26152250. The on-chain router is not impersonated, and the EOA's later VISTA approval of it is not used; the EOA transfers 1 wei of its own VISTA to the fresh router. That router then runs both swaps on the live pair. Swap 1 pulls 21.365578479614736555 WETH, the output the wrapped product allows, and the true uint256 product falls. The donation, sync, and second swap use the trace amounts.", "name": "EtherVista", "path": "src/test/2026-10/EtherVista_exp.sol", "receipts": [{"label": "The commit", "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/commit/b80744e6c0ec1b36a36d90961b6e30c2a313f1e3"}, {"label": "Replay file", "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/e6a9d80a61a88672acb5c2ce979522ed79246ea0/src/test/2026-10/EtherVista_exp.sol"}, {"label": "README section", "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/e6a9d80a61a88672acb5c2ce979522ed79246ea0/README.md#20261009-ethervista-ethervistapair-swap-multiplies-its-two-uint112-reserves-inside-the-k-check-so-on-solidity-0-5-16-the-product-wraps-modulo-2-to-the-112-and-the-check-passes-after-the-real-reserve-product-has-fallen-swap-accepts-only-factory-router-the-routersetter-had-just-pointed-that-router-at-the-attacker-s-contract-and-the-contract-paid-1-wei-of-vista-for-21-365578479614736555-weth-then-after-a-permissionless-sync-swapped-4-860669107788601981-weth-of-that-haul-for-43855-902196275763910452-vista"}], "recordedAt": "2026-11-13T03:10:48Z", "sourceId": "defihacklabs", "text": "DeFiHackLabs added a replay of the EtherVista attack from October 9, 2026. The replay is a test anyone can run to see how it worked. Their notes say: Lost: 7.477952467865157795 WETH and 43,855.902196275763910451 VISTA taken from the VISTA/WETH pair on Ethereum, both asserted to the wei on the attacker EOA and as the pair's loss. The attacker later sold 7.46802069 ETH for 18,590.71646 USDC, which is the reported ~$18.6K, and burned the VISTA; that sale is a later transaction and is not part of this PoC. The PoC forks at block 26152249, one block before setRouter, deploys a fresh router, and repeats the privileged call: routerSetter 0xCA90D843288E35beeADfCe14E5F906e3F1AFc7cB calls setRouter on that contract, the same call it sent to 0x469424b628a9d2036e41496e814Db500D683b120 in tx 0xc97ad886a4cbd022edc33deaa44656d66814fe3df1142d03802c96ce7632cc7a at block 26152250. The on-chain router is not impersonated, and the EOA's later VISTA approval of it is not used; the EOA transfers 1 wei of its own VISTA to the fresh router. That router then runs both swaps on the live pair. Swap 1 pulls 21.365578479614736555 WETH, the output the wrapped product allows, and the true uint256 product falls. The donation, sync, and second swap use the trace amounts..", "v": 1}}, "parsed": {"action": "added", "credit": "Kept by SunWeb3Sec (github.com/SunWeb3Sec/DeFiHackLabs), Apache-2.0.", "day": "2026-10-09", "kind": "watch-hack", "lost": "Lost: 7.477952467865157795 WETH and 43,855.902196275763910451 VISTA taken from the VISTA/WETH pair on Ethereum, both asserted to the wei on the attacker EOA and as the pair's loss. The attacker later sold 7.46802069 ETH for 18,590.71646 USDC, which is the reported ~$18.6K, and burned the VISTA; that sale is a later transaction and is not part of this PoC. The PoC forks at block 26152249, one block before setRouter, deploys a fresh router, and repeats the privileged call: routerSetter 0xCA90D843288E35beeADfCe14E5F906e3F1AFc7cB calls setRouter on that contract, the same call it sent to 0x469424b628a9d2036e41496e814Db500D683b120 in tx 0xc97ad886a4cbd022edc33deaa44656d66814fe3df1142d03802c96ce7632cc7a at block 26152250. The on-chain router is not impersonated, and the EOA's later VISTA approval of it is not used; the EOA transfers 1 wei of its own VISTA to the fresh router. That router then runs both swaps on the live pair. Swap 1 pulls 21.365578479614736555 WETH, the output the wrapped product allows, and the true uint256 product falls. The donation, sync, and second swap use the trace amounts.", "name": "EtherVista", "path": "src/test/2026-10/EtherVista_exp.sol", "receipts": [{"label": "The commit", "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/commit/b80744e6c0ec1b36a36d90961b6e30c2a313f1e3"}, {"label": "Replay file", "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/e6a9d80a61a88672acb5c2ce979522ed79246ea0/src/test/2026-10/EtherVista_exp.sol"}, {"label": "README section", "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/e6a9d80a61a88672acb5c2ce979522ed79246ea0/README.md#20261009-ethervista-ethervistapair-swap-multiplies-its-two-uint112-reserves-inside-the-k-check-so-on-solidity-0-5-16-the-product-wraps-modulo-2-to-the-112-and-the-check-passes-after-the-real-reserve-product-has-fallen-swap-accepts-only-factory-router-the-routersetter-had-just-pointed-that-router-at-the-attacker-s-contract-and-the-contract-paid-1-wei-of-vista-for-21-365578479614736555-weth-then-after-a-permissionless-sync-swapped-4-860669107788601981-weth-of-that-haul-for-43855-902196275763910452-vista"}], "recordedAt": "2026-11-13T03:10:48Z", "sourceId": "defihacklabs", "text": "DeFiHackLabs added a replay of the EtherVista attack from October 9, 2026. The replay is a test anyone can run to see how it worked. Their notes say: Lost: 7.477952467865157795 WETH and 43,855.902196275763910451 VISTA taken from the VISTA/WETH pair on Ethereum, both asserted to the wei on the attacker EOA and as the pair's loss. The attacker later sold 7.46802069 ETH for 18,590.71646 USDC, which is the reported ~$18.6K, and burned the VISTA; that sale is a later transaction and is not part of this PoC. The PoC forks at block 26152249, one block before setRouter, deploys a fresh router, and repeats the privileged call: routerSetter 0xCA90D843288E35beeADfCe14E5F906e3F1AFc7cB calls setRouter on that contract, the same call it sent to 0x469424b628a9d2036e41496e814Db500D683b120 in tx 0xc97ad886a4cbd022edc33deaa44656d66814fe3df1142d03802c96ce7632cc7a at block 26152250. The on-chain router is not impersonated, and the EOA's later VISTA approval of it is not used; the EOA transfers 1 wei of its own VISTA to the fresh router. That router then runs both swaps on the live pair. Swap 1 pulls 21.365578479614736555 WETH, the output the wrapped product allows, and the true uint256 product falls. The donation, sync, and second swap use the trace amounts..", "v": 1}, "project": {"projectId": 18, "name": "DeFi hack replays (DeFiHackLabs)", "kind": "watch", "keeper": "SunWeb3Sec", "jurisdiction": "", "markText": "DH", "shape": "", "what": "DeFiHackLabs, a collection of tests that replay public DeFi attacks so anyone can see how they worked", "repoUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs", "credit": "Kept by SunWeb3Sec (github.com/SunWeb3Sec/DeFiHackLabs), Apache-2.0.", "chunk": "item"}, "date": "2026-11-13", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}