# Pandora: integer underflow in transferFrom drains Uniswap pair

Pandora token's transferFrom underflow allowed draining Uniswap V2 pair reserves by manipulating balances and syncing, netting ~$17K.

- Payout: Real-world hack
- Severity: high
- Program: Pandora
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/PANDORA_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240208-pandora
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Pandora ERC20 token and Uniswap V2 pair
**Root cause:** Pandora's transferFrom lacks proper balance checks, allowing an integer underflow when transferring from the pair to the token contract itself, which artificially inflates the pair's token balance.
**Steps:**
1. Fork mainnet at block 19184577.
2. Get PANDORA balance of Uniswap V2 pair: `pandora_balance = PANDORA.balanceOf(V2_PAIR)`.
3. Call `PANDORA.transferFrom(V2_PAIR, PANDORA, pandora_balance - 1)` to underflow and move almost all tokens to the token contract.
4. Call `V2_PAIR.sync()` to update reserves to the new low token balance.
5. Call `PANDORA.transferFrom(PANDORA, V2_PAIR, pandora_balance - 1)` to move tokens back to the pair.
6. Compute swap amount using formula: `amountin * 9975 * ethReserve / (oldPANDORAReserve * 10000 + amountin * 9975)`.
7. Call `V2_PAIR.swap(swapAmount, 0, attacker, '')` to extract WETH.
**How found:** Likely identified the missing balance check in Pandora's transferFrom implementation, enabling underflow when sender balance is insufficient.
**Exploitation:** Attacker manipulated the Uniswap V2 pair's PANDORA reserves via underflow in transferFrom, then swapped the inflated PANDORA for WETH, draining ~$17K from the pair.
**Insight:** When auditing tokens with custom transferFrom, check for missing balance checks that allow underflow, especially when interacting with AMM pairs where reserve manipulation can be profitable.