# CEXISWAP: uninitialized proxy reinitialized to drain USDT

CEXISWAP proxy lacked initialization guard, allowing attacker to reinitialize and upgrade to malicious implementation, draining ~$30K USDT.

- Payout: Real-world hack
- Severity: high
- Program: CEXISWAP
- Analysis by: DeFiHackLabs
- Disclosed: 2023-09-21
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-09/CEXISWAP_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230921-cexiswap
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:misconfiguration

**Target:** Upgradeable proxy contract (CEXISWAP) on Ethereum
**Root cause:** The proxy contract's initialize function was callable by anyone, and the upgradeToAndCall function lacked access control, allowing arbitrary implementation replacement.
**Steps:**
1. Call `CEXISWAP.initialize("HAX", "HAX", address(this), address(this), address(this), address(this))` to set attacker as admin/treasury/community/strategy.
2. Call `CEXISWAP.upgradeToAndCall(address(this), abi.encodePacked(this.exploit2.selector))` to set malicious implementation and delegatecall exploit2.
3. In exploit2, execute `USDT.transfer(owner, USDT.balanceOf(address(this)))` to drain USDT held by the proxy.
**Exploitation:** Attacker reinitialized the proxy to gain admin rights, then upgraded to a malicious implementation that transferred all USDT from the proxy to the attacker.
**Insight:** Upgradeable proxies must have initialization protection and access-controlled upgrade functions; check for uninitialized or publicly initializable proxies.