# Four.meme: pre-initialized PancakeSwap pool skews migration price

Four.meme migration used createAndInitializePoolIfNecessary, so an attacker pre-created the PancakeSwap pool at a skewed sqrtPriceX96 and drained ~186k via cheap token swaps.

- Payout: Real-world hack
- Severity: high
- Program: FourMeme
- Credited: DeFiHackLabs
- Disclosed: 2025-02-11
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/FourMeme_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250211-fourmeme
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:recon vuln:business-logic vuln:oracle-manipulation

**Target:** BSC memecoin launchpad migration to PancakeSwap V3
**Root cause:** Migration called createAndInitializePoolIfNecessary without checking whether the pool already existed, so liquidity was added at the attacker-chosen sqrtPriceX96 instead of the fair bonding-curve price.
**Steps:**
1. Attacker buys meme token cheaply on four.meme via `buyTokenAMAP` (0.0001 BNB -> ~1603 tokens).
2. Attacker calls `createAndInitializePoolIfNecessary(memeToken, wbnb, fee, sqrtPriceX96=1e40)` on PancakeSwap router, pre-creating the pool at an absurd price.
3. Victim token reaches 24 BNB market cap; four.meme owner calls `addLiquidity(memeToken, 27169599998237907265358521)`, which adds ~23.5 WBNB + 200M tokens into the attacker's pre-initialized pool.
4. Attacker swaps 1603 meme tokens through the pool with `sqrtPriceLimitX96=4295128740`, receiving ~23.4 WBNB, then unwraps WETH.
**How found:** Recognized that migration used createAndInitializePoolIfNecessary (idempotent create) and that anyone could front-run pool creation for a predictable token address, letting the attacker dictate the initial price.
**Exploitation:** Pre-create and initialize the PancakeSwap V3 pool for the target memecoin at a huge sqrtPriceX96 before the launchpad migrates. When four.meme adds liquidity, it deposits real WBNB into the skewed pool; the attacker then swaps their cheaply-acquired tokens out for most of that WBNB.
**Escalation:** Repeated across ~20 different meme tokens on the same launchpad using the same pre-initialization trick.
**Insight:** On launchpad-to-DEX migrations, check whether pool creation is idempotent and permissionless; if the token address is predictable, pre-create the pool at an extreme sqrtPriceX96 so the migration's addLiquidity lands at your price.