# Uerii Token: unprotected mint() drains Uniswap liquidity

Uerii token's mint() lacked access control, letting an attacker mint unlimited tokens and swap them for ~$2.4k USDC on Uniswap.

- Payout: Real-world hack
- Severity: high
- Program: Uerii Token
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/Uerii_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221017-uerii
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control

**Target:** ERC-20 token contract mint function
**Root cause:** The mint() function on the Uerii token contract had no access control, allowing any caller to mint arbitrary tokens to themselves.
**Steps:**
1. Call `UERII_TOKEN.mint()` to mint tokens to the attacker contract.
2. Approve Uniswap router to spend UERII: `UERII_TOKEN.approve(address(UNI_ROUTER), type(uint256).max)`.
3. Swap minted UERII for USDC via `UNI_ROUTER.exactInputSingle` with fee 500.
4. Approve USDC and swap all USDC for WETH via `UNI_ROUTER.exactInputSingle`.
**Exploitation:** Attacker called the unprotected mint() to create UERII tokens, then sold them on Uniswap V3 UERII/USDC pool for USDC, then swapped USDC to WETH, netting ~$2.4k.
**Insight:** Check token contracts for mint/burn functions lacking onlyOwner or role checks; a single unguarded mint can be monetized by dumping into the token's deepest liquidity pool.