# SWT token: public burn corrupts pair reserves, drains WAVAX

Unverified SWT token exposed public burn(address,uint256), letting attacker burn pair's SWT then sync reserves and drain WAVAX.

- Payout: Real-world hack
- Severity: medium
- Program: unverified
- Credited: DeFiHackLabs
- Disclosed: 2025-03-18
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-03/unverified_3f27_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250318-unverified-3f27
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Uniswap V2-style SWT/WAVAX pair on Avalanche
**Root cause:** SWT token exposed a public burn(address,uint256) that could burn tokens from any address, including the liquidity pair, without authorization.
**Steps:**
1. Wrap 0.5 AVAX to WAVAX and transfer to SWT/WAVAX pair
2. Call `pair.swap(10e18, 0, attackContract, "")` to receive 10 SWT
3. Call `swt.burn(SWT_WAVAX_PAIR, pairSwtBalance - 1)` to burn almost all SWT held by the pair
4. Call `pair.sync()` to force reserve update with corrupted SWT balance
5. Transfer 10 SWT back to pair
6. Call `pair.swap(0, wavax.balanceOf(pair) - 1, attackContract, "")` to drain WAVAX
7. Unwrap WAVAX and selfdestruct to forward AVAX to attacker
**How found:** Likely identified the unverified SWT token's public burn function and recognized that burning the pair's token balance before a sync would manipulate reserves, enabling a profitable swap.
**Exploitation:** Attacker deployed a constructor-based contract funded with 0.5 AVAX, wrapped to WAVAX and seeded the pair, swapped for 10 SWT, burned the pair's SWT balance down to 1 wei via the public burn function, forced a sync to corrupt reserves, then swapped the 10 SWT back to drain nearly all WAVAX from the pair, netting ~0.40 WAVAX profit.
**Insight:** When auditing unverified tokens, check for public burn/mint functions that can target arbitrary addresses, especially the liquidity pair; burning pair tokens then syncing can create a massive price imbalance exploitable via swap.