# MetaDragon: unrestricted mint via transfer to self drains liquidity

MetaDragon token contract lacked access control on transfer, allowing attacker to mint tokens to self and swap for ~$180k on BSC.

- Payout: Real-world hack
- Severity: high
- Program: MetaDragon
- Analysis by: DeFiHackLabs
- Disclosed: 2024-05-29
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-05/MetaDragon_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240529-metadragon
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** BEP-20 token contract on BSC
**Root cause:** The transfer function allowed unrestricted minting when the recipient was the token contract itself or the ERC721 contract, due to a flawed condition `if (to == address(this) || to == erc721) { transform(value); }`.
**Steps:**
1. Call `transfer(meta_token, i)` for i from 0 to 39, sending tokens to the contract itself, triggering the mint logic.
2. Attacker's balance increases by the minted amount.
3. Approve Uniswap router to spend meta_token.
4. Swap minted meta_token for WBNB via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
**Exploitation:** Attacker repeatedly called transfer with the token contract as recipient, minting tokens to themselves. They then approved the PancakeSwap router and swapped the minted tokens for WBNB, draining liquidity for ~$180k.
**Insight:** Look for transfer functions with special-case logic when `to` is the contract itself or a specific address; such conditions often bypass balance checks and enable minting.