# TheNFTV2: burn/transfer loop mints TheDAO tokens, drains Uniswap

TheNFTV2 burn/transfer logic allowed repeated minting of TheDAO tokens via NFT burn and transfer from dead address, draining Uniswap liquidity for ~$19K.

- Payout: Real-world hack
- Severity: high
- Program: TheNFTV2
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-25
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/TheNFTV2_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231125-thenftv2
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** NFT contract and Uniswap V2 pair
**Root cause:** TheNFTV2's burn and transferFrom functions allowed an attacker to repeatedly burn an NFT and transfer it from the dead address, each time receiving TheDAO tokens, without proper balance checks or state updates.
**Steps:**
1. Attacker calls `THENFTV2.transferFrom(hacker, attackContract, nftId)` to move NFT to attack contract.
2. Attack contract initiates a Uniswap flash swap borrowing WETH via `uniswap.swap(0, 1_906_331_836_125_411_716, address(this), new bytes(1))`.
3. In `uniswapV2Call`, loop: `THENFTV2.approve(address(this), nftId); THENFTV2.burn(nftId); THENFTV2.transferFrom(deadaddress, address(this), nftId);` until TheDAO balance >= amountIn.
4. Transfer TheDAO tokens to Uniswap pair to repay flash loan.
5. Withdraw WETH to ETH and keep profit.
**Exploitation:** Attacker used a flash swap to borrow WETH, then repeatedly burned and re-transferred the NFT from the dead address to mint TheDAO tokens, swapped them for WETH to repay the flash loan, and kept the remaining WETH as profit (~$19K).
**Insight:** Look for NFT contracts where burn and transferFrom from the dead address can be looped to mint associated ERC20 tokens without proper accounting; test flash-loan-funded loops against Uniswap pairs holding the token.