# BTC24H: unlimited claim() mints tokens, drains liquidity

BTC24H lock contract's claim() allowed unlimited token minting; attacker minted tokens and swapped them for USDT and WBTC via Uniswap Universal Router.

- Payout: Real-world hack
- Severity: high
- Program: BTC24H
- Credited: DeFiHackLabs
- Disclosed: 2024-12-16
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-12/BTC24H_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241216-btc24h
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic

**Target:** BTC24H lock contract on Polygon
**Root cause:** The claim() function in the Lock contract lacked proper validation, allowing an attacker to claim an arbitrary amount of BTC24H tokens without depositing or locking any assets.
**Steps:**
1. Call `ILock(LOCK).claim()` to mint a large amount of BTC24H tokens to the attack contract.
2. Transfer 10,000 BTC24H tokens to Uniswap Universal Router.
3. Execute a swap via Universal Router with command `0x00` (V3_SWAP_EXACT_IN) to exchange BTC24H for USDT, using the encoded path `BTC24H -> USDT`.
4. Transfer 100,000 BTC24H tokens to Universal Router.
5. Execute another swap to exchange BTC24H for WBTC, using the encoded path `BTC24H -> WBTC`.
**Exploitation:** Attacker called claim() to mint BTC24H tokens for free, then used Uniswap Universal Router to swap the minted tokens for USDT and WBTC, draining liquidity from the pools.
**Insight:** Check claim/mint functions for missing access control or validation that allows unlimited token generation; test if minted tokens can be swapped for valuable assets on DEXs.