# PikeFinance: uninitialized proxy leads to 1.4M drain

Uninitialized proxy in PikeFinance was initialized by attacker, then upgraded to malicious implementation to drain 1.4M.

- Payout: Real-world hack
- Severity: critical
- Program: PikeFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-30
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/PikeFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240430-pikefinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Upgradeable proxy contract
**Root cause:** The proxy contract was left uninitialized, allowing anyone to call initialize() and become owner. The owner could then upgrade the implementation to arbitrary code.
**Steps:**
1. Call `initialize(address(this), address(this), address(this), address(this), 20, 20)` on proxy `0xFC7599cfFea9De127a9f9C748CCb451a34d2F063` to set attacker as owner.
2. Deploy malicious implementation with a `withdraw(address)` function that transfers ETH balance.
3. Call `upgradeToAndCall(address(maliciousImpl), abi.encodeWithSignature("withdraw(address)", address(this)))` on proxy to upgrade and execute withdraw.
4. Malicious withdraw sends entire contract balance to attacker.
**How found:** Attacker likely noticed the proxy contract was uninitialized by checking its owner or initialization state on-chain, then exploited the public initialize function.
**Exploitation:** Attacker called initialize to become owner, then upgraded proxy to a contract with a withdraw function that drained the proxy's ETH balance (1.4M) to the attacker.
**Insight:** Always check if upgradeable proxy contracts are initialized; uninitialized proxies allow anyone to become owner and upgrade to malicious implementation.