# TecraSpace: burnFrom without allowance drains Uniswap pool

TecraSpace TCR token's burnFrom lacked allowance check, letting attacker burn pool's TCR and sync reserves to drain 639k USDT.

- Payout: Real-world hack
- Severity: high
- Program: TecraSpace
- Analysis by: DeFiHackLabs
- Disclosed: 2022-02-04
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-02/TecraSpace_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220204-tecraspace
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** TCR ERC20 token contract and Uniswap V2 TCR/USDT pair
**Root cause:** TCR's burnFrom function did not verify that the caller had allowance from the 'from' address, allowing anyone to burn tokens from any address including the Uniswap pair.
**Steps:**
1. Attacker obtains TCR via Uniswap swapExactETHForTokens along WETH->USDT->TCR path.
2. Call `TCR.burnFrom(pool, poolTCRbalance - 100_000_000)` to burn most of the pair's TCR balance without approval.
3. Call `pool.sync()` to update reserves to the manipulated TCR balance.
4. Swap attacker's remaining TCR for USDT via Uniswap, receiving inflated USDT due to skewed reserves.
**Exploitation:** Attacker used 0.04 ETH to buy TCR, burned the pair's TCR reserves via unprotected burnFrom, synced the pool to reflect the new low TCR reserve, then sold their TCR for a large amount of USDT, netting 639,222 USDT.
**Insight:** Check token contracts for burnFrom/burn functions that lack allowance checks; such functions can be used to manipulate AMM pool reserves when the token is paired.