# FireToken: pair manipulation via transfer function drains WETH

FireToken's _transfer function allowed pair manipulation via transfer to the Uniswap pair, enabling an attacker to drain 8.45 ETH using a flash loan.

- Payout: Real-world hack
- Severity: high
- Program: FireToken
- Credited: DeFiHackLabs
- Disclosed: 2024-10-01
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-10/FireToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241001-firetoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** FireToken ERC20 contract and Uniswap V2 pair
**Root cause:** The _transfer function in FireToken (L274-279) likely allows transferring tokens to the Uniswap pair without updating reserves correctly, enabling manipulation of the pair's token balance to skew swap calculations.
**Steps:**
1. Flash loan 20 WETH from Aave.
2. Repeatedly create AttackerC2 contracts that deposit WETH, swap for FIRE via UniswapV2Router02, then transfer the pair's entire FIRE balance to the pair, and call swap() to extract WETH.
3. Each iteration drains WETH from the pair due to manipulated reserves.
4. Repay flash loan and keep profit.
**How found:** Likely identified by reviewing the _transfer function and noticing that direct transfers to the pair could manipulate reserves without proper synchronization, then crafting a flash loan attack to exploit the mispricing.
**Exploitation:** Attacker used Aave flash loan to borrow 20 WETH, then in a loop deployed contracts that swapped WETH for FIRE, artificially inflated the pair's FIRE balance by transferring tokens directly to the pair, and called swap() to extract WETH at a manipulated rate, repeating until the pair was drained.
**Insight:** When a token's transfer function allows sending tokens directly to a Uniswap pair, it can be used to manipulate reserves and skew swap outputs; always check if the pair's balance can be arbitrarily inflated.