# MCAI tax wallet allowance bypass drains Uniswap pair

MCAI tax wallet bypassed transferFrom allowance, drained MCAI from Uniswap V2 pair, synced reserves, sold for 12.03 WETH profit.

- Payout: Real-world hack
- Severity: high
- Program: MCAI
- Credited: DeFiHackLabs
- Disclosed: 2025-01-28
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/MCAI_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250128-mcai
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ERC20 token tax wallet and Uniswap V2 pair
**Root cause:** The MCAI tax wallet contract could call transferFrom on the Uniswap V2 pair without the pair having granted allowance, bypassing standard ERC20 allowance accounting.
**Steps:**
1. Identify MCAI tax wallet at `0x810B5902CB2ac2Fa63dFE4A6935EA32aED975cc8` and MCAI/WETH pair at `0x660a6619574e87d12Ba7Fa3F5679D5D7F587A4fE`.
2. Confirm pair allowance to tax wallet is zero: `IERC20(MCAI).allowance(pair, taxWallet) == 0`.
3. From tax wallet context, call `IERC20(MCAI).transferFrom(pair, exploitContract, drainAmount)` where `drainAmount = pairBalance - pairBalance/10000`.
4. Call `Uni_Pair_V2(pair).sync()` to update reserves to the tiny remaining MCAI balance.
5. Approve router and swap drained MCAI for ETH via `swapExactTokensForETHSupportingFeeOnTransferTokens`.
6. Forward ETH profit to attacker EOA.
**How found:** Likely identified that the tax wallet contract could call transferFrom on the pair without approval, enabling direct pair balance drain.
**Exploitation:** Attacker used the tax wallet's ability to bypass allowance to pull nearly all MCAI from the Uniswap V2 pair, synced the pair to a tiny MCAI reserve, then sold the drained MCAI through the Uniswap V2 router for 12.03 WETH profit.
**Insight:** Check whether privileged contracts (tax wallets, fee receivers) can call transferFrom on liquidity pairs without allowance; a single unapproved transferFrom can drain a pair and be amplified by sync.