# GHT: transferFrom reserve manipulation drains WETH pair

GHT token's transferFrom allowed moving tokens from the WETH/GHT pair to the token contract, then back to the pair, manipulating reserves for a profitable swap.

- Payout: Real-world hack
- Severity: high
- Program: GHT
- Analysis by: DeFiHackLabs
- Disclosed: 2024-03-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-03/GHT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240307-ght
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** GHT token contract and WETH/GHT Uniswap V2 pair
**Root cause:** GHT.transferFrom permits arbitrary transfers from the WETH/GHT pair to the GHT contract and back, letting an attacker alter the pair's reserves without a real swap.
**Steps:**
1. Fork mainnet at attack tx block.
2. Read GHT balance of WETH_GHT pair: `amount = GHT.balanceOf(WETH_GHT)`.
3. Call `GHT.transferFrom(WETH_GHT, GHT, amount - 1)` to move almost all GHT from pair to token contract.
4. Call `WETH_GHT.sync()` to update reserves to near-zero GHT.
5. Read GHT balance of GHT contract: `amount = GHT.balanceOf(GHT)`.
6. Call `GHT.transferFrom(GHT, WETH_GHT, amount)` to return all GHT to pair.
7. Compute swap output using standard Uniswap V2 formula with manipulated reserves.
8. Call `WETH_GHT.swap(0, amountOut, address(this), "")` to extract WETH.
**Exploitation:** Attacker used GHT.transferFrom to drain GHT from the pair to the token contract, synced the pair to near-zero GHT reserves, then transferred all GHT back to the pair. This created a large imbalance that allowed a swap to extract WETH from the pair, netting ~$57K.
**Insight:** Check if token transferFrom can be called by anyone to move tokens from a liquidity pair to the token contract itself; such arbitrary transfers can be used to manipulate pair reserves via sync and then swap for profit.