# Civfund: missing access control on mint callback drains approvals

Civfund's uniswapV3MintCallback lacked access control, letting an attacker pull tokens users had approved to the contract, stealing ~$165k.

- Payout: Real-world hack
- Severity: high
- Program: Civfund
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/Civfund_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230708-civfund
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Uniswap V3-style mint callback on a DeFi contract
**Root cause:** The contract's uniswapV3MintCallback (and mint) had no access control, so anyone could invoke it and trigger transferFrom of tokens users had approved to the vulnerable contract.
**Steps:**
1. Attacker contract calls vulnerable contract at `0x7CAEC5E4a3906d0919895d113F7Ed9b3a0cbf826` with selector `0x5ffe72b7` (mint) for each victim.
2. Vulnerable contract calls back into attacker's `mint(...)`, which invokes `uniswapV3MintCallback(...)`.
3. Callback causes the vulnerable contract to transferFrom each victim's approved token balance to the attacker.
4. Repeat across 31 victims to collect USDT, BONE, WOOF, LEASH, SANI, ONE, CELL, USDC, SHIB (~$165k).
**Exploitation:** Attacker deployed a contract that repeatedly called the unprotected mint function on Civfund; the contract's callback path executed transferFrom against users' outstanding approvals, moving their tokens to the attacker. No capital or flash loan needed—only existing approvals.
**Insight:** Uniswap V3 callback functions (uniswapV3MintCallback) must verify msg.sender is the pool; if a project reuses this pattern without that check, any user's standing approval to the contract becomes drainable via a single external call.