# NGFS: unprotected proxy sync drains PancakeSwap pair

NGFS token on BSC had unprotected delegateCallReserves and setProxySync functions, allowing attacker to set proxy and drain ~190K USDT from PancakeSwap pair.

- Payout: Real-world hack
- Severity: high
- Program: NGFS
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-25
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/NGFS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240425-ngfs
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** NGFS token contract on BSC
**Root cause:** Functions delegateCallReserves and setProxySync lack access control, allowing anyone to set the proxy address and manipulate reserve synchronization.
**Steps:**
1. Fork BSC at block 38167372.
2. Call `delegateCallReserves()` on NGFS token.
3. Call `setProxySync(address(this))` to set attacker contract as proxy.
4. Get NGFS-USDT pair address via PancakeFactory.
5. Call `reserveMultiSync(address(this), balanceOf(pair))` to credit attacker with pair's NGFS balance.
6. Approve PancakeRouter to spend NGFS tokens.
7. Swap all NGFS tokens for USDT via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
**Exploitation:** Attacker called unprotected functions to set themselves as proxy and sync reserves, inflating their NGFS balance to match the pair's balance, then sold those tokens on PancakeSwap for USDT, draining ~190K.
**Insight:** Look for token contracts with public functions that set proxy or sync reserves; these can often be abused to mint or reallocate balances before swapping on DEXs.