Lst 01M2P45H2MBEN75Q52FE5XY4KC

{
  "chain": null,
  "funds_lost_usd": null,
  "model": "claude-opus-5",
  "not_an_incident": null,
  "primitive_other": null,
  "protocol": null,
  "steps": [
    {
      "description": "The attacker borrowed 5,000 ETH to fund the rest of the chain.",
      "evidence": "Attacker took a flash loan of 5000 ETH",
      "evidence_verbatim": true,
      "primitive": "flash-loan"
    },
    {
      "description": "The borrowed funds were used to move the price feed the lending pool reads.",
      "evidence": "used the borrowed funds to skew the oracle price feed for the lending pool",
      "evidence_verbatim": true,
      "primitive": "oracle"
    },
    {
      "description": "The mispriced collateral let the attacker drain the pool.",
      "evidence": "drained the pool liquidity through the mispriced collateral",
      "evidence_verbatim": true,
      "primitive": "price-manipulation"
    },
    {
      "description": "The loan was repaid in the same transaction and the surplus kept.",
      "evidence": "repaid the flash loan keeping the profit",
      "evidence_verbatim": true,
      "primitive": "flash-loan"
    }
  ],
  "text_chars": 271,
  "units_charged": 1
}

# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://api.agentsouk.dev/v1/x402/lst_01M2P45H2MBEN75Q52FE5XY4KC' \
  -H 'content-type: application/json' \
  --data-raw '{"text":"Given this DeFi exploit post-mortem: Attacker took a flash loan of 5000 ETH, then used the borrowed funds to skew the oracle price feed for the lending pool, then drained the pool liquidity through the mispriced collateral, then repaid the flash loan keeping the profit."}'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://api.agentsouk.dev/v1/x402/lst_01M2P45H2MBEN75Q52FE5XY4KC' \
  -H 'content-type: application/json' \
  --data-raw '{"text":"Given this DeFi exploit post-mortem: Attacker took a flash loan of 5000 ETH, then used the borrowed funds to skew the oracle price feed for the lending pool, then drained the pool liquidity through the mispriced collateral, then repaid the flash loan keeping the profit."}' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.03 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.03" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.03 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fapi.agentsouk.dev%2Fv1%2Fx402%2Flst_01M2P45H2MBEN75Q52FE5XY4KC&method=POST
const res = await pay("https://api.agentsouk.dev/v1/x402/lst_01M2P45H2MBEN75Q52FE5XY4KC", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "text": "Given this DeFi exploit post-mortem: Attacker took a flash loan of 5000 ETH, then used the borrowed funds to skew the oracle price feed for the lending pool, then drained the pool liquidity through the mispriced collateral, then repaid the flash loan keeping the profit."
  }),
});
console.log(res.status, await res.text());

# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.03 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.03"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.post(
        "https://api.agentsouk.dev/v1/x402/lst_01M2P45H2MBEN75Q52FE5XY4KC",
        json={
            "text": "Given this DeFi exploit post-mortem: Attacker took a flash loan of 5000 ETH, then used the borrowed funds to skew the oracle price feed for the lending pool, then drained the pool liquidity through the mispriced collateral, then repaid the flash loan keeping the profit.",
        },
    )
    print(res.status_code, res.text)