# Melo: unprotected mint() drains liquidity pool

Melo token's public mint() lacked access control, letting an attacker mint 50x the pair's balance and dump it for ~$90k USDT.

- Payout: Real-world hack
- Severity: critical
- Program: Melo
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/Melo_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230506-melo
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BEP-20 token contract mint() function on BSC
**Root cause:** The MEL token's mint(address,uint256,string) function had no access control, so anyone could mint arbitrary tokens.
**Steps:**
1. Fork BSC at block 27960445
2. Read `MEL.balanceOf(address(Pair))` and multiply by 50 to size the mint
3. Call `MEL.mint(address(this), mintAmount, "")` to mint unbacked tokens
4. Approve the router and swap MEL->USDT via `swapExactTokensForTokensSupportingFeeOnTransferTokens`
5. Collect USDT proceeds
**Exploitation:** Attacker minted 50x the pair's MEL balance to themselves for free, then swapped the inflated supply through PancakeSwap into USDT, draining the pool of ~$90k.
**Insight:** On BSC tokens, check whether mint/burn/admin functions are externally callable without modifiers; sizing the mint to a multiple of pool reserves maximizes drain in one swap.