# Uwerx: faulty fee logic enables pair manipulation drain

Uwerx token's faulty fee-on-transfer logic let an attacker manipulate the WERX/WETH pair via skim/sync to drain ~176 ETH.

- Payout: Real-world hack
- Severity: high
- Program: Uwerx
- Analysis by: DeFiHackLabs
- Disclosed: 2023-08-02
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-08/Uwerx_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230802-uwerx
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** WERX token contract and Uniswap V2 WERX/WETH pair
**Root cause:** The WERX token's fee-on-transfer logic was faulty, allowing an attacker to manipulate the token balance of the Uniswap pair and profit from the discrepancy.
**Steps:**
1. Obtain 20,000 WETH (mocked via flash loan in PoC).
2. Approve Router to spend WETH and WERX.
3. Call `pair.sync()` to update reserves.
4. Swap 20,000 WETH for WERX via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
5. Transfer `4_429_817_738_575_912_760_684_500` WERX directly to the pair.
6. Call `pair.skim(address(0x01))` to remove excess tokens, then `pair.sync()`.
7. Swap all WERX back to WETH via the Router.
8. Profit ~176 ETH.
**How found:** Likely identified through analysis of the token's fee-on-transfer implementation and its interaction with Uniswap V2 pair reserve mechanics.
**Exploitation:** Attacker flash-loaned 20,000 WETH, swapped for WERX, then donated a large amount of WERX to the pair, called skim to extract the excess, synced reserves, and swapped back to WETH for a profit of ~176 ETH.
**Insight:** Fee-on-transfer tokens can create reserve discrepancies when combined with skim/sync; always verify that token transfers adjust pair balances correctly and that skim cannot be abused to extract value.