# SafeMoon: public mint/burn drains PancakeSwap pair

SafeMoon's public mint/burn functions let an attacker mint tokens from the bridge burn address, then burn the pair's balance and sync to drain $8.9M.

- Payout: Real-world hack
- Severity: critical
- Program: SafeMoon Hack
- Analysis by: DeFiHackLabs
- Disclosed: 2023-03-28
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-03/safeMoon_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230328-safemoon
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** SafeMoon token contract and PancakeSwap pair
**Root cause:** The SafeMoon token exposes unrestricted public mint() and burn() functions. An attacker can mint tokens to themselves by passing the bridgeBurnAddress balance, and burn tokens from the PancakeSwap pair to manipulate reserves.
**Steps:**
1. Fork BSC at block 26,854,757.
2. Call `sfmoon.mint(address(this), sfmoon.balanceOf(sfmoon.bridgeBurnAddress()))` to mint ~81.8e18 tokens to the attacker.
3. Flash-swap 1000 WETH from the PancakeSwap pair via `pancakePair.swap(1000 ether, 0, address(this), "ggg")`.
4. In pancakeCall, swap WETH for SafeMoon via the SafeSwapTradeRouter.
5. Burn almost all SafeMoon from the pair: `sfmoon.burn(sfmoon.uniswapV2Pair(), sfmoon.balanceOf(sfmoon.uniswapV2Pair()) - 1_000_000_000)`.
6. Burn all SafeMoon held by the token contract itself: `sfmoon.burn(address(sfmoon), sfmoon.balanceOf(address(sfmoon)))`.
7. Call `IUniswapV2Pair(sfmoon.uniswapV2Pair()).sync()` to update reserves.
8. Swap the attacker's SafeMoon balance back to WETH via the router.
9. Repay the flash loan: `weth.transfer(msg.sender, (amount0 * 10_030) / 10_000)`.
**How found:** Likely identified that mint() and burn() were externally callable without access control, and that burning the pair's tokens followed by sync() would manipulate the price.
**Exploitation:** Attacker used a flash loan of 1000 WETH from the SafeMoon-WETH PancakeSwap pair. They minted SafeMoon from the bridge burn address, swapped WETH for SafeMoon, burned the pair's SafeMoon balance and the token contract's own balance, synced the pair to drastically reduce SafeMoon reserves, then sold the minted SafeMoon for WETH at the inflated price, repaying the flash loan and keeping the profit.
**Insight:** Check token contracts for public mint/burn functions; if present, see if burning from the AMM pair and calling sync() can skew reserves for a profitable swap.