# WXETA Diamond: unprotected initialize and mint drain PancakePair

WXETA Diamond's unprotected initialize() let attacker set max allowance, then mint() inflated PancakePair reserves to drain ~110K USD via swap.

- Payout: Real-world hack
- Severity: high
- Program: WXETA
- Credited: DeFiHackLabs
- Disclosed: 2024-09-15
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-09/WXETA_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240915-wxeta
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BSC Diamond proxy contract (WXETA) and PancakeSwap pair
**Root cause:** initialize(uint256) was callable by anyone and set an unlimited allowance/approval state; mint(address,uint256) was also unrestricted, letting the attacker mint tokens directly to the PancakePair to manipulate its reserves.
**Steps:**
1. Fork BSC at block 42284161
2. Call `IWXetaDiamond(WXetaDiamond).initialize(type(uint256).max)` to set max allowance
3. Call `mint(PancakePair, 1000000000000000 * 1e18)` to inflate pair reserves with WXETA
4. Read BUSD balance of pair, call `PancakePair.swap(0, balPair - 1e18, attacker, "")` to extract BUSD
5. Approve router, `swapExactTokensForETH(bal, 0, [BUSD, WBNB], attacker, block.timestamp)` to convert to BNB
6. Send 0.01 BNB to addr2, selfdestruct to attacker
**How found:** Not described; likely source review of the Diamond's initialize/mint functions revealing missing access control.
**Exploitation:** Attacker deployed a contract that called the unauthenticated initialize() to grant itself max allowance, minted a huge WXETA supply directly into the PancakePair, then used swap() to pull nearly all BUSD out of the pair and laundered via PancakeRouter to BNB.
**Insight:** On Diamond/proxy contracts, check whether initialize() is guarded by an initializer modifier and whether mint/burn functions have role checks — an unguarded mint to a DEX pair is a direct reserve-manipulation primitive.