# HNet: burn via multicall manipulates pair reserves

HNet token burn via multicall and forwarder signature bypass let attacker burn pair tokens, sync reserves, and drain ~2.4 WBNB.

- Payout: Real-world hack
- Severity: medium
- Program: HNet
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/HNet_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231207-hnet
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm vuln:access-control vuln:business-logic

**Target:** HNet token contract and PancakeSwap pair
**Root cause:** The burn function allows burning tokens from an arbitrary address (the pair) via multicall, and the forwarder execute accepts a signature without proper validation, enabling arbitrary calls.
**Steps:**
1. Flash loan 0.1 WBNB from DODO.
2. Swap WBNB for HNet tokens via PancakeRouter.
3. Call Forwarder.execute with a crafted ForwardRequest containing multicall data that calls HNet.burn(1_970_000e18, pairAddress).
4. Call Pair.sync() to update reserves after burning pair's HNet balance.
5. Swap remaining HNet tokens for WBNB via PancakeRouter.
6. Repay flash loan.
**Exploitation:** Attacker flash-loaned WBNB, bought HNet, used a forged signature to execute a multicall that burned the pair's HNet tokens, synced the pair to inflate HNet price, then sold remaining HNet for profit.
**Insight:** Look for token contracts exposing burn or transferFrom via multicall without access control, especially when paired with a forwarder that may accept arbitrary signatures; burning pair tokens then syncing can manipulate reserves.