# Fantasm Finance: mint() decimal error mints unbacked XFTM

Fantasm Finance's mint() lacked a minimum FTM input check and had a decimal error in calcMint, letting an attacker mint XFTM with only FSM and drain ~$2.62M.

- Payout: Real-world hack
- Severity: critical
- Program: Fantasm Finance
- Analysis by: DeFiHackLabs
- Disclosed: 2022-03-09
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-03/Fantasm_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220309-fantasm
- Tags: area:web3 domain:web3 impact:funds-loss impact:mass-exploit kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** Fantasm Pool contract mint()/calcMint() on Fantom
**Root cause:** mint() failed to enforce a minimum FTM input, and calcMint's formula had a decimal/precision error making _xftmOut larger than intended, so depositing only FSM minted excess XFTM.
**Steps:**
1. Attacker funds via BNB Chain through Tornado Cash, swaps BNB to USDC on PancakeSwap, bridges USDC to Fantom via Celer Bridge.
2. Deploy exploit contract 0x944b58... on Fantom.
3. Approve FSM to pool and call `pool.mint(100_000_000_000_000_000_000, 1)` sending only FSM, no FTM; decimal error inflates _xftmOut.
4. Call `pool.collect()` to receive the excess XFTM.
5. Sell XFTM for FTM, buy more FSM, repeat mint/collect/sell to compound.
6. Swap FTM to ETH, bridge to Ethereum via Celer, launder through Tornado Cash.
**Exploitation:** Attacker supplied only FSM collateral (no FTM) to mint(), exploiting the missing minimum-input check and calcMint decimal error to receive inflated XFTM, collected it, sold into the pool for FTM, and looped to drain ~1008 ETH (~$2.62M), bridged to Ethereum and sent to Tornado Cash.
**Escalation:** Repeated mint/collect/sell loop with growing FSM amounts compounded the drain; cross-chain bridging and Tornado Cash obscured funds.
**Insight:** When auditing mint functions, check that every collateral leg has an enforced minimum/nonzero input and verify the price/ratio formula's precision scaling; a missing FTM-side check plus a decimal error lets one-sided deposits mint unbacked synthetic tokens.