# BEGO: signature bypass in mint() enables unlimited token minting

BEGO token's mint() accepted empty signature arrays, letting attacker mint 1e12 tokens and dump them for ~12 WBNB on PancakeSwap.

- Payout: Real-world hack
- Severity: high
- Program: BEGO
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-20
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/BEGO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221020-bego
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:auth-bypass vuln:signature-replay

**Target:** BEGO token contract mint() function on BSC
**Root cause:** The mint() function's signature verification did not properly validate the provided signatures, allowing an attacker to pass empty arrays and bypass authorization.
**Steps:**
1. Call `BEGO_TOKEN.mint(1_000_000_000_000 * 1e18, "t", address(this), _r, _s, _v)` with empty `_r`, `_s`, `_v` arrays.
2. Approve PancakeSwap router to spend minted BEGO tokens.
3. Swap all minted BEGO for WBNB via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
**Exploitation:** Attacker called mint() with empty signature arrays to mint 1e12 BEGO tokens to their contract, then swapped them for WBNB on PancakeSwap, crashing the price and netting ~12 WBNB.
**Insight:** When a mint function accepts signature arrays, test whether empty arrays or zero-length inputs bypass verification; always check that signature count matches required signers.