# TSURU: unvalidated onERC1155Received mints tokens for free

TSURU wrapper's onERC1155Received minted tokens without validation, letting attacker mint 167.2M tokens and swap for 137.9 ETH (~$140K).

- Payout: Real-world hack
- Severity: high
- Program: TSURU
- Analysis by: DeFiHackLabs
- Disclosed: 2024-05-10
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-05/TSURU_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240510-tsuru
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** ERC1155 wrapper contract on Base
**Root cause:** The wrapper's onERC1155Received function mints wrapper tokens based on the amount parameter without verifying that a corresponding ERC1155 transfer actually occurred, allowing anyone to call it directly and mint arbitrary tokens.
**Steps:**
1. Call `wrapper.onERC1155Received(address(0), address(this), 0, 418, new bytes(0))` on the vulnerable contract `0x75Ac62EA5D058A7F88f0C3a5F8f73195277c93dA`.
2. Observe that the caller receives 167,200,000 ether of wrapper tokens (expectedTokens).
3. Swap the minted tokens for WETH via Uniswap V3 pool `0x913b1658dd001dFF93D3AF2A657523F1eed53917` using a swap with sqrtPriceLimit set to extreme.
4. Receive 137.904 ETH in the attacker contract.
**Exploitation:** Attacker directly called the public onERC1155Received function with a large amount (418) to mint 167.2M wrapper tokens without depositing any underlying ERC1155 tokens. Then swapped those tokens for WETH on a Uniswap V3 pool, draining ~137.9 ETH (~$140K).
**Insight:** Public ERC1155 receiver hooks that mint based on the amount parameter without checking msg.sender or verifying a prior transfer are a direct mint vulnerability; always verify the caller is a legitimate ERC1155 contract and that the transfer actually happened.