# Miner: missing dst validation drains Uniswap V3 pool

Miner token's transferFrom lacked dst validation, letting attacker drain Uniswap V3 pool via repeated transfers in swap callback.

- Payout: Real-world hack
- Severity: high
- Program: MINER
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-15
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/Miner_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240215-miner
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic

**Target:** Miner ERC20 token and Uniswap V3 pool
**Root cause:** The Miner token's transferFrom function did not validate the destination address, allowing tokens to be moved to arbitrary addresses including the pool.
**Steps:**
1. Attacker transfers Miner tokens from their address to attack contract via `MINER.transfer(address(this), MINER.balanceOf(attacker))`.
2. Attacker calls `pool.swap(address(this), false, 999999999999999998000, 1461446703485210103287273052203988822378723970340, abi.encodePacked(uint8(0x61)))` on Uniswap V3 pool.
3. In `uniswapV3SwapCallback`, loop 2000 times: `MINER.transfer(address(pool), 499999999999999999)` and `MINER.transfer(address(this), 499999999999999999)`.
4. Pool receives Miner tokens, allowing attacker to extract WETH.
**Exploitation:** Attacker used a flash swap on Uniswap V3, then in the callback repeatedly transferred Miner tokens to the pool and back to the attack contract, exploiting the lack of destination validation to manipulate pool balances and drain ~140 ETH.
**Insight:** When auditing ERC20 tokens, check transferFrom for missing validation of the `to` address; such flaws can be exploited via callback loops in DEX interactions to drain pools.