Skip to content

Latest commit

 

History

History
523 lines (487 loc) · 26 KB

attack-transaction.md

File metadata and controls

523 lines (487 loc) · 26 KB

Attack transaction

The attacker used a transaction https://bscscan.com/tx/0x085beaf22438287312d56620973b9c00a82b99a44a6cf1f00ef6c88ab3656464 to

Raw Transaction Data

Function: multicall(tuple[] calls) ***

MethodID: 0xcaa5c23f
[0]:  0000000000000000000000000000000000000000000000000000000000000020
[1]:  0000000000000000000000000000000000000000000000000000000000000005
[2]:  00000000000000000000000000000000000000000000000000000000000000a0
[3]:  00000000000000000000000000000000000000000000000000000000000007e0
[4]:  00000000000000000000000000000000000000000000000000000000000008e0
[5]:  0000000000000000000000000000000000000000000000000000000000000960
[6]:  0000000000000000000000000000000000000000000000000000000000000a00
[7]:  000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693
[8]:  0000000000000000000000000000000000000000000000000000000000000040
[9]:  00000000000000000000000000000000000000000000000000000000000006c4
[10]: d9b1849500000000000000000000000000000000000000000000000000000000
[11]: 0000002000000000000000000000000000000000000000000000000000000000
[12]: 0000000200000000000000000000000000000000000000000000000000000000
[13]: 0000004000000000000000000000000000000000000000000000000000000000
[14]: 00000600000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5
[15]: f132769300000000000000000000000000000000000000000000000000000000
[16]: 0000004000000000000000000000000000000000000000000000000000000000
[17]: 00000544146b8253000000000000000000000000000000000000000000000000
[18]: 0000000000000040000000000000000000000000000000000000000000000000
[19]: 0000000000000500000000000000000000000000000000000000000000000000
[20]: 0000000000000004000000000000000000000000000000000000000000000000
[21]: 0000000000000080000000000000000000000000000000000000000000000000
[22]: 00000000000001e0000000000000000000000000000000000000000000000000
[23]: 00000000000002a0000000000000000000000000000000000000000000000000
[24]: 000000000000042000000000000000000000000091191a15e778d46255fc9acd
[25]: 37d028228d97e786000000000000000000000000000000000000000000000000
[26]: 0000000000000040000000000000000000000000000000000000000000000000
[27]: 00000000000000e44885b2540000000000000000000000004b64f382aa063c07
[28]: f1c55cf53c66cce3b6fd0bb00000000000000000000000000000000000000000
[29]: 0000000000000000000000600000000000000000000000000000000000000000
[30]: 0000000000000000000000a00000000000000000000000000000000000000000
[31]: 000000000000000000000001000000000000000000000000cd62dde0e5acbc1d
[32]: 596b1c1699c8b2a5f13276930000000000000000000000000000000000000000
[33]: 0000000000000000000000010000000000000000000000000000000000000000
[34]: 002afb7c108d64a9177c00000000000000000000000000000000000000000000
[35]: 000000000000000000000000000000000000000091191a15e778d46255fc9acd
[36]: 37d028228d97e786000000000000000000000000000000000000000000000000
[37]: 0000000000000040000000000000000000000000000000000000000000000000
[38]: 0000000000000044095ea7b300000000000000000000000010ed43c718714eb6
[39]: 3d5aa57b78b54704e256024effffffffffffffffffffffffffffffffffffffff
[40]: ffffffffffffffffffffffff0000000000000000000000000000000000000000
[41]: 000000000000000000000000000000000000000010ed43c718714eb63d5aa57b
[42]: 78b54704e256024e000000000000000000000000000000000000000000000000
[43]: 0000000000000040000000000000000000000000000000000000000000000000
[44]: 00000000000001045c11d7950000000000000000000000000000000000000000
[45]: 002afb7c108d64a9177c00000000000000000000000000000000000000000000
[46]: 0000000000000000000000000000000000000000000000000000000000000000
[47]: 0000000000000000000000a0000000000000000000000000cd62dde0e5acbc1d
[48]: 596b1c1699c8b2a5f13276930000000000000000000000000000000000000000
[49]: 00000000000000e8d4a50fff0000000000000000000000000000000000000000
[50]: 00000000000000000000000200000000000000000000000091191a15e778d462
[51]: 55fc9acd37d028228d97e786000000000000000000000000bb4cdb9cbd36b01b
[52]: d1cbaebf2de08d9173bc095c0000000000000000000000000000000000000000
[53]: 00000000000000000000000000000000000000005df712fb47651986b1f972a8
[54]: c71e364a37b207d1000000000000000000000000000000000000000000000000
[55]: 0000000000000040000000000000000000000000000000000000000000000000
[56]: 0000000000000004919840ad0000000000000000000000000000000000000000
[57]: 0000000000000000000000000000000000000000000000000000000000000000
[58]: 0000000000000001000000000000000000000000000000000000000000000000
[59]: 0000000000000004000000000000000000000000000000000000000000000000
[60]: 00000000000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5
[61]: f132769300000000000000000000000000000000000000000000000000000000
[62]: 0000004000000000000000000000000000000000000000000000000000000000
[63]: 0000000434c2c130000000000000000000000000000000000000000000000000
[64]: 0000000000000000000000000000000000000000000000000000000000000000
[65]: 000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693
[66]: 0000000000000000000000000000000000000000000000000000000000000040
[67]: 0000000000000000000000000000000000000000000000000000000000000084
[68]: 8014bad300000000000000000000000000000000000000000000000000000000
[69]: 00000040000000000000000000000000e183128b965ac347a5a082080cb9b663
[70]: 5faf904300000000000000000000000000000000000000000000000000000000
[71]: 00000001000000000000000000000000bb4cdb9cbd36b01bd1cbaebf2de08d91
[72]: 73bc095c00000000000000000000000000000000000000000000000000000000
[73]: 000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693
[74]: 0000000000000000000000000000000000000000000000000000000000000040
[75]: 0000000000000000000000000000000000000000000000000000000000000004
[76]: c230df7300000000000000000000000000000000000000000000000000000000
[77]: 000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693
[78]: 0000000000000000000000000000000000000000000000000000000000000040
[79]: 0000000000000000000000000000000000000000000000000000000000000024
[80]: c4d1776100000000000000000000000000000000000000000000000000000000
[81]: 015b4ae400000000000000000000000000000000000000000000000000000000
[82]: 0000000000000000000000005df712fb47651986b1f972a8c71e364a37b207d1
[83]: 0000000000000000000000000000000000000000000000000000000000000040
[84]: 0000000000000000000000000000000000000000000000000000000000000004
[85]: 919840ad00000000000000000000000000000000000000000000000000000000

Analysis

Call was to multicall([](address, bytes)) (function selector 0xcaa5c23f), where the address was the contract to call, and bytes is the calldata to be called.

Offset of array
0000000000000000000000000000000000000000000000000000000000000020
Array length
0000000000000000000000000000000000000000000000000000000000000005
Ofset of element [0]
00000000000000000000000000000000000000000000000000000000000000a0
Ofset of element [1]
00000000000000000000000000000000000000000000000000000000000007e0
Ofset of element [2]
00000000000000000000000000000000000000000000000000000000000008e0
Ofset of element [3]
0000000000000000000000000000000000000000000000000000000000000960
Ofset of element [4]
0000000000000000000000000000000000000000000000000000000000000a00

Start of element [0] {
  address
  000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693  <--- attack contract
  offset of bytes within element[0]
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    00000000000000000000000000000000000000000000000000000000000006c4
    bytes contents   <--- see analysis of this below
    [000]: d9b1849500000000000000000000000000000000000000000000000000000000
    [020]: 0000002000000000000000000000000000000000000000000000000000000000
    [040]: 0000000200000000000000000000000000000000000000000000000000000000
    [060]: 0000004000000000000000000000000000000000000000000000000000000000
    [080]: 00000600000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5
    [0A0]: f132769300000000000000000000000000000000000000000000000000000000
    [0C0]: 0000004000000000000000000000000000000000000000000000000000000000
    [0E0]: 00000544146b8253000000000000000000000000000000000000000000000000
    [100]: 0000000000000040000000000000000000000000000000000000000000000000
    [120]: 0000000000000500000000000000000000000000000000000000000000000000
    [140]: 0000000000000004000000000000000000000000000000000000000000000000
    [160]: 0000000000000080000000000000000000000000000000000000000000000000
    [180]: 00000000000001e0000000000000000000000000000000000000000000000000
    [1A0]: 00000000000002a0000000000000000000000000000000000000000000000000
    [1C0]: 000000000000042000000000000000000000000091191a15e778d46255fc9acd
    [1E0]: 37d028228d97e786000000000000000000000000000000000000000000000000
    [200]: 0000000000000040000000000000000000000000000000000000000000000000
    [220]: 00000000000000e44885b2540000000000000000000000004b64f382aa063c07
    [240]: f1c55cf53c66cce3b6fd0bb00000000000000000000000000000000000000000
    [260]: 0000000000000000000000600000000000000000000000000000000000000000
    [280]: 0000000000000000000000a00000000000000000000000000000000000000000
    [2A0]: 000000000000000000000001000000000000000000000000cd62dde0e5acbc1d
    [2C0]: 596b1c1699c8b2a5f13276930000000000000000000000000000000000000000
    [2E0]: 0000000000000000000000010000000000000000000000000000000000000000
    [300]: 002afb7c108d64a9177c00000000000000000000000000000000000000000000
    [320]: 000000000000000000000000000000000000000091191a15e778d46255fc9acd
    [340]: 37d028228d97e786000000000000000000000000000000000000000000000000
    [360]: 0000000000000040000000000000000000000000000000000000000000000000
    [380]: 0000000000000044095ea7b300000000000000000000000010ed43c718714eb6
    [3A0]: 3d5aa57b78b54704e256024effffffffffffffffffffffffffffffffffffffff
    [3C0]: ffffffffffffffffffffffff0000000000000000000000000000000000000000
    [3E0]: 000000000000000000000000000000000000000010ed43c718714eb63d5aa57b
    [400]: 78b54704e256024e000000000000000000000000000000000000000000000000
    [420]: 0000000000000040000000000000000000000000000000000000000000000000
    [440]: 00000000000001045c11d7950000000000000000000000000000000000000000
    [460]: 002afb7c108d64a9177c00000000000000000000000000000000000000000000
    [480]: 0000000000000000000000000000000000000000000000000000000000000000
    [4A0]: 0000000000000000000000a0000000000000000000000000cd62dde0e5acbc1d
    [4C0]: 596b1c1699c8b2a5f13276930000000000000000000000000000000000000000
    [4E0]: 00000000000000e8d4a50fff0000000000000000000000000000000000000000
    [500]: 00000000000000000000000200000000000000000000000091191a15e778d462
    [520]: 55fc9acd37d028228d97e786000000000000000000000000bb4cdb9cbd36b01b
    [540]: d1cbaebf2de08d9173bc095c0000000000000000000000000000000000000000
    [560]: 00000000000000000000000000000000000000005df712fb47651986b1f972a8
    [580]: c71e364a37b207d1000000000000000000000000000000000000000000000000
    [5A0]: 0000000000000040000000000000000000000000000000000000000000000000
    [5C0]: 0000000000000004919840ad0000000000000000000000000000000000000000
    [5E0]: 0000000000000000000000000000000000000000000000000000000000000000
    [600]: 0000000000000001000000000000000000000000000000000000000000000000
    [620]: 0000000000000004000000000000000000000000000000000000000000000000
    [640]: 00000000000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5
    [660]: f132769300000000000000000000000000000000000000000000000000000000
    [680]: 0000004000000000000000000000000000000000000000000000000000000000
    [6A0]: 0000000434c2c130000000000000000000000000000000000000000000000000
    [6C0]: 0000000000000000000000000000000000000000000000000000000000000000
  }
}
Start of element [1] {
  address
  000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693  <--- attack contract
  offset of bytes within element[0]
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000084
    bytes contents
    [000]: 8014bad300000000000000000000000000000000000000000000000000000000
    [020]: 00000040000000000000000000000000e183128b965ac347a5a082080cb9b663
    [040]: 5faf904300000000000000000000000000000000000000000000000000000000
    [060]: 00000001000000000000000000000000bb4cdb9cbd36b01bd1cbaebf2de08d91
    [080]: 73bc095c00000000000000000000000000000000000000000000000000000000
  }
}
Start of element [2] {
  address
  000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693  <--- attack contract
  offset of bytes within element[0]
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000004
    bytes contents
    [000] c230df7300000000000000000000000000000000000000000000000000000000
  }
}
Start of element [3] {
  address
  000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693  <--- attack contract
  offset of bytes within element[0]
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000024
    bytes contents
    [000]: c4d1776100000000000000000000000000000000000000000000000000000000
    [020]: 015b4ae400000000000000000000000000000000000000000000000000000000
  }
}
Start of element [4] {
  address
  0000000000000000000000005df712fb47651986b1f972a8c71e364a37b207d1
  offset of bytes within element[0]
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000004
    bytes contents
    [000]: 919840ad00000000000000000000000000000000000000000000000000000000

The first four calls are to the attack contract.

The last call is to this one: 5df712fb47651986b1f972a8c71e364a37b207d1. This contract is quite small, and should be reasonably easy to analyse.

Analysis of top level Element[0]

This appears to be a call to a function (function selector 0xd9b18495), that takes as parameters [](address, bytes)) on the attack contract.

offset of array
0000000000000000000000000000000000000000000000000000000000000020
length of array
0000000000000000000000000000000000000000000000000000000000000002
offset of array element[0]
0000000000000000000000000000000000000000000000000000000000000040
offset of array element[1]
0000000000000000000000000000000000000000000000000000000000000600

Start of array element[0] {
  address
  000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693   <--- attack contract
  offset of bytes
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000544
    bytes contents   <--- see analysis of this below
    [000]: 146b825300000000000000000000000000000000000000000000000000000000
    [020]: 0000004000000000000000000000000000000000000000000000000000000000
    [040]: 0000050000000000000000000000000000000000000000000000000000000000
    [060]: 0000000400000000000000000000000000000000000000000000000000000000
    [080]: 0000008000000000000000000000000000000000000000000000000000000000
    [0A0]: 000001e000000000000000000000000000000000000000000000000000000000
    [0C0]: 000002a000000000000000000000000000000000000000000000000000000000
    [0E0]: 0000042000000000000000000000000091191a15e778d46255fc9acd37d02822
    [100]: 8d97e78600000000000000000000000000000000000000000000000000000000
    [120]: 0000004000000000000000000000000000000000000000000000000000000000
    [140]: 000000e44885b2540000000000000000000000004b64f382aa063c07f1c55cf5
    [160]: 3c66cce3b6fd0bb0000000000000000000000000000000000000000000000000
    [180]: 0000000000000060000000000000000000000000000000000000000000000000
    [1A0]: 00000000000000a0000000000000000000000000000000000000000000000000
    [1C0]: 0000000000000001000000000000000000000000cd62dde0e5acbc1d596b1c16
    [1E0]: 99c8b2a5f1327693000000000000000000000000000000000000000000000000
    [200]: 00000000000000010000000000000000000000000000000000000000002afb7c
    [220]: 108d64a9177c0000000000000000000000000000000000000000000000000000
    [240]: 0000000000000000000000000000000091191a15e778d46255fc9acd37d02822
    [260]: 8d97e78600000000000000000000000000000000000000000000000000000000
    [280]: 0000004000000000000000000000000000000000000000000000000000000000
    [2A0]: 00000044095ea7b300000000000000000000000010ed43c718714eb63d5aa57b
    [2C0]: 78b54704e256024effffffffffffffffffffffffffffffffffffffffffffffff
    [2E0]: ffffffffffffffff000000000000000000000000000000000000000000000000
    [300]: 0000000000000000000000000000000010ed43c718714eb63d5aa57b78b54704
    [320]: e256024e00000000000000000000000000000000000000000000000000000000
    [340]: 0000004000000000000000000000000000000000000000000000000000000000
    [360]: 000001045c11d7950000000000000000000000000000000000000000002afb7c
    [380]: 108d64a9177c0000000000000000000000000000000000000000000000000000
    [3A0]: 0000000000000000000000000000000000000000000000000000000000000000
    [3C0]: 00000000000000a0000000000000000000000000cd62dde0e5acbc1d596b1c16
    [3E0]: 99c8b2a5f1327693000000000000000000000000000000000000000000000000
    [400]: 000000e8d4a50fff000000000000000000000000000000000000000000000000
    [420]: 000000000000000200000000000000000000000091191a15e778d46255fc9acd
    [440]: 37d028228d97e786000000000000000000000000bb4cdb9cbd36b01bd1cbaebf
    [460]: 2de08d9173bc095c000000000000000000000000000000000000000000000000
    [480]: 000000000000000000000000000000005df712fb47651986b1f972a8c71e364a
    [4A0]: 37b207d100000000000000000000000000000000000000000000000000000000
    [4C0]: 0000004000000000000000000000000000000000000000000000000000000000
    [4E0]: 00000004919840ad000000000000000000000000000000000000000000000000
    [500]: 0000000000000000000000000000000000000000000000000000000000000000
    [520]: 0000000100000000000000000000000000000000000000000000000000000000
    [540]: 0000000400000000000000000000000000000000000000000000000000000000
  }
}
Start of array element[1] {
  address
  000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693   <--- attack contract
  offset of bytes
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000004
    bytes contents   <--- see analysis of this below
    34c2c13000000000000000000000000000000000000000000000000000000000   <-- could be depositeAll()

Analysis of top level Element[1]

This appears to be a call to a function (function selector 0x8014bad3), which could be transferAll(address[],address) on the attack contract. The calldata matches this function signature.

It appears to be: transfer from bb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c to e183128b965ac347a5a082080cb9b6635faf9043.

offset of array
0000000000000000000000000000000000000000000000000000000000000040
address
000000000000000000000000e183128b965ac347a5a082080cb9b6635faf9043
length of array
0000000000000000000000000000000000000000000000000000000000000001
Start of array element[0] {
  address
  000000000000000000000000bb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c
}

Analysis of top level Element[2]

This appears to be a call to a function (function selector 0xc230df73), which appears to take no parameters, on the attack contract.

Analysis of top level Element[3]

This appears to be a call to a function (function selector 0xc4d17761), which appears to take one parameter, on the attack contract.

Maybe the parameter is a function selector passed in as a uint256?

Parameter
00000000000000000000000000000000000000000000000000000000015b4ae4

Analysis of top level Element[4]

This call is to contract: 5df712fb47651986b1f972a8c71e364a37b207d1.

It is for function check() (function selector 919840ad).

Analysis of top level Element[0]'s Element[0]

The call is to the attack contract with function selector (0x146b8253). Parameters appear to be ([](address, bytes), []uint256).

Offset of complex type: [](address, bytes)
0000000000000000000000000000000000000000000000000000000000000040
Offset of complex type: [](uint256)
0000000000000000000000000000000000000000000000000000000000000500

Start of complex type: [](address, bytes)

Number of array elements
0000000000000000000000000000000000000000000000000000000000000004
Offset of [0]
0000000000000000000000000000000000000000000000000000000000000080
Offset of [1]
00000000000000000000000000000000000000000000000000000000000001e0
Offset of [2]
00000000000000000000000000000000000000000000000000000000000002a0
Offset of [3]
0000000000000000000000000000000000000000000000000000000000000420
Element [0] {
  address
  00000000000000000000000091191a15e778d46255fc9acd37d028228d97e786 <-- LPR token contract
  offset of bytes
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    00000000000000000000000000000000000000000000000000000000000000e4
    contents of bytes
    [000]: 4885b2540000000000000000000000004b64f382aa063c07f1c55cf53c66cce3
    [020]: b6fd0bb000000000000000000000000000000000000000000000000000000000
    [040]: 0000006000000000000000000000000000000000000000000000000000000000
    [060]: 000000a000000000000000000000000000000000000000000000000000000000
    [080]: 00000001000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5
    [0A0]: f132769300000000000000000000000000000000000000000000000000000000
    [0C0]: 000000010000000000000000000000000000000000000000002afb7c108d64a9
    [0E0]: 177c000000000000000000000000000000000000000000000000000000000000
  }
}
Element [1] {
  address
  00000000000000000000000091191a15e778d46255fc9acd37d028228d97e786  <-- LPR token contract
  offset of bytes
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000044
    contents of bytes
    [000]: 095ea7b300000000000000000000000010ed43c718714eb63d5aa57b78b54704
    [020]: e256024effffffffffffffffffffffffffffffffffffffffffffffffffffffff
    [040]: ffffffff00000000000000000000000000000000000000000000000000000000
  }
}
Element [2] {
  address
  00000000000000000000000010ed43c718714eb63d5aa57b78b54704e256024e  <-- PancapeSwap v2
  offset of bytes
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000104
    contents of bytes
    [000]: 5c11d7950000000000000000000000000000000000000000002afb7c108d64a9
    [020]: 177c000000000000000000000000000000000000000000000000000000000000
    [040]: 0000000000000000000000000000000000000000000000000000000000000000
    [060]: 000000a0000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5
    [080]: f1327693000000000000000000000000000000000000000000000000000000e8
    [0A0]: d4a50fff00000000000000000000000000000000000000000000000000000000
    [0C0]: 0000000200000000000000000000000091191a15e778d46255fc9acd37d02822
    [0E0]: 8d97e786000000000000000000000000bb4cdb9cbd36b01bd1cbaebf2de08d91
    [100]: 73bc095c00000000000000000000000000000000000000000000000000000000
  }
}
Element [3] {
  address
  0000000000000000000000005df712fb47651986b1f972a8c71e364a37b207d1  <-- unknown contract
  offset of bytes
  0000000000000000000000000000000000000000000000000000000000000040
  bytes {
    length of bytes
    0000000000000000000000000000000000000000000000000000000000000004
    contents of bytes
    [000]: 919840ad00000000000000000000000000000000000000000000000000000000
  }
}

Start of complex type: [](uint256)
Number of array elements
0000000000000000000000000000000000000000000000000000000000000001
Array element [0]:
0000000000000000000000000000000000000000000000000000000000000004

Analysis of Element[0]'s Element[0]'s Element[0]

The call is to LPR token contract (91191a15e778d46255fc9acd37d028228d97e786) with function batchTransferFrom(address,address[],uint256[]) (function selector 4885b254).

address
0000000000000000000000004b64f382aa063c07f1c55cf53c66cce3b6fd0bb0
offset of array of address
0000000000000000000000000000000000000000000000000000000000000060
offset of array of uint256
00000000000000000000000000000000000000000000000000000000000000a0

[]address {
  number of elements
  0000000000000000000000000000000000000000000000000000000000000001
  array element[0]
  000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693
}
[]uint256 {
  number of elements
  0000000000000000000000000000000000000000000000000000000000000001
  array element[0]
  0000000000000000000000000000000000000000002afb7c108d64a9177c0000  <-- Amount of LPR stolen
}

Analysis of Element[0]'s Element[0]'s Element[1]

The call is to LPR token contract (91191a15e778d46255fc9acd37d028228d97e786) with function approve(address,uint256) (function selector 095ea7b3).

address
00000000000000000000000010ed43c718714eb63d5aa57b78b54704e256024e
uint256
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

Analysis of Element[0]'s Element[0]'s Element[2]

The call is to PancapeSwap v2 contract (10ed43c718714eb63d5aa57b78b54704e256024e) with function swapExactTokensForTokensSupportingFeeOnTransferTokens(uint256,uint256,address[],address,uint256) (function selector 5c11d795).

uint256
0000000000000000000000000000000000000000002afb7c108d64a9177c0000   <-- Amount of LPR stolen
uint256
0000000000000000000000000000000000000000000000000000000000000000
offset of array
00000000000000000000000000000000000000000000000000000000000000a0
address
000000000000000000000000cd62dde0e5acbc1d596b1c1699c8b2a5f1327693
uint256
000000000000000000000000000000000000000000000000000000e8d4a50fff
number of element in array
0000000000000000000000000000000000000000000000000000000000000002
address [0] - LPR token contract
00000000000000000000000091191a15e778d46255fc9acd37d028228d97e786
address [1] - Binance WBNB Token
000000000000000000000000bb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c

Analysis of Element[0]'s Element[0]'s Element[3]

The call is to unknown contract (5df712fb47651986b1f972a8c71e364a37b207d1) with function check() (function selector 919840ad).