# APEMAGA: family() balance manipulation drains Uniswap pair

APEMAGA token's family() function let attacker inflate the pair's token balance, then sync() and swap drained ~9 ETH from the Uniswap V2 pool.

- Payout: Real-world hack
- Severity: high
- Program: APEMAGA
- Analysis by: DeFiHackLabs
- Disclosed: 2024-06-27
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/APEMAGA_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240627-apemaga
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC20 token APEMAGA and its Uniswap V2 pair
**Root cause:** The token's family(address) function mutates balances of an arbitrary account (the pair) without transferring tokens, letting an attacker inflate the pair's APEMAGA reserve.
**Steps:**
1. Swap 0.1 WETH for ~8000 APEMAGA via Uniswap V2 router
2. Call `Apemaga.family(address(Pair))` three times to inflate pair's APEMAGA balance
3. Call `Pair.sync()` to commit the manipulated reserve
4. Approve router and `swapExactTokensForTokens` all APEMAGA for WETH, extracting ~9 ETH
**Exploitation:** Attacker bought a small amount of APEMAGA, then repeatedly invoked family() on the pair address to artificially raise the pair's token reserve, synced it, and sold the inflated balance back through the router for WETH profit.
**Insight:** Look for token functions that write balances/reserves of arbitrary addresses (e.g. rebasing, reflection, or 'family' style hooks) — calling them on the pair address then sync() lets you mint reserves out of thin air.