# FILX DN404: unprotected init/withdraw drains FLIX tokens

FILX DN404 proxy lacked access control on init/withdraw, letting attacker drain FLIX tokens and swap them for USDT on Uniswap V3.

- Payout: Real-world hack
- Severity: high
- Program: FILX DN404
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/DN404_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240210-dn404
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control

**Target:** Proxy contract (0x2c71...dad4) with init and withdraw functions
**Root cause:** The proxy contract's init and withdraw functions were callable by anyone, allowing an attacker to re-initialize the proxy and withdraw all FLIX tokens held by it.
**Steps:**
1. Call `IProxy(victim).init(IERC20(WETH), 1, 1e18)` to re-initialize the proxy with attacker-controlled parameters.
2. Call `IProxy(victim).withdraw(IERC20(FLIX), amount, address(this))` where amount is the proxy's entire FLIX balance.
3. Swap the stolen FLIX for USDT via Uniswap V3 pair `0xa743...Df97` using `swap(address(this), true, 685e21, 4295128740, "")`.
4. In the swap callback, transfer the required FLIX to the pair to complete the swap and receive USDT.
**Exploitation:** Attacker called init to reset the proxy's token and period, then withdraw to transfer all FLIX tokens from the proxy to the attacker's contract. The attacker then sold the FLIX on Uniswap V3 for USDT, netting ~200K USD.
**Insight:** Proxy contracts with unprotected init functions can be re-initialized to change critical parameters; always check if init/withdraw functions have proper access control, especially in upgradeable or proxy patterns.