# PancakeSwap Content Injection Bugfix Review

PancakeSwap's Crowdin localization API key had full write access, letting anyone inject arbitrary text into the live site for phishing.

- Payout: $7,500
- Severity: critical
- Program: PancakeSwap
- Credited: Kadabra
- Disclosed: 2021-06-09
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/pancakeswap-content-injection-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-content-injection-bugfix-review
- Tags: domain:web impact:integrity kind:bounty platform:blog platform:immunefi sev:critical tech:rest technique:js-analysis vuln:misconfiguration vuln:secrets-leak

**Target:** Crowdin localization API used by PancakeSwap website
**Root cause:** The Crowdin API key embedded in the site's frontend requests was a full write-access token rather than read-only, allowing creation and approval of translations.
**Steps:**
1. Navigate to PancakeSwap website and change language
2. Inspect network traffic for the `GET https://api.crowdin.com/api/v2/projects/422458/languages/es-ES/translations?field=6&limit=200` request
3. Extract the API key from request headers
4. Create a new translation via Crowdin `api.projects.translations.post`
5. Approve the translation via Crowdin `api.projects.approvals.post`; altered text appears live on site
**How found:** Whitehat inspected network traffic while changing site language and noticed the Crowdin API key exposed in request headers, then tested whether it had write permissions.
**Exploitation:** Attacker extracts the write-capable Crowdin API key from frontend traffic, then uses Crowdin API to create and approve a translation overwriting site strings, injecting phishing text or malicious swap prompts shown to all users.
**Insight:** Localization/i18n backends (Crowdin, Lokalise) are often wired with over-privileged tokens exposed client-side; check language-switch requests for API keys and test write scope on the translation API.