# TokenFactory: fake factory hijacks pair to drain stuck LP

TokenFactory trusted attacker-supplied router/factory, recorded an unrelated HODOGE/WBNB pair, then burned its stuck LP tokens for ~657 USD of WBNB.

- Payout: Real-world hack
- Severity: high
- Program: TokenFactory
- Credited: DeFiHackLabs
- Disclosed: 2025-06-08
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/TokenFactory_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250608-tokenfactory
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** TokenFactory contract on BSC
**Root cause:** createTokenAndAddLiquidity accepted caller-supplied swapRouter/swapFactory and stored the pair returned by the fake factory without verifying it matched the newly created token. transferPair then let the attacker redirect the factory's stuck LP tokens to that arbitrary pair.
**Steps:**
1. Deploy `FakeFactory` whose `getPair()` returns the existing HODOGE/WBNB pair `0xda4f...4F5d`.
2. Deploy `FakeRouter` with a no-op `addLiquidityETH` returning zeros.
3. Call `createTokenAndAddLiquidity{value: fee}(tokenInfo, 0, fakeRouter, fakeFactory, WBNB)` so the new token records the victim pair.
4. Call `transferPair(fakeToken, HODOGE_WBNB_PAIR)` to move TokenFactory's stuck LP balance to the pair.
5. Call `IUniswapV2Pair(HODOGE_WBNB_PAIR).burn(ATTACKER)` to redeem reserves as WBNB.
**How found:** Likely spotted that createTokenAndAddLiquidity takes router/factory as parameters and stores the pair returned by the factory without checking it corresponds to the new token, plus that the factory held stuck LP tokens of an unrelated pair.
**Exploitation:** Attacker paid only the factory fee, supplied fake router/factory to make the factory adopt a pre-existing valuable pair, redirected the factory's stuck LP tokens into that pair, and burned them to extract ~0.9+ WBNB (~657 USD) of reserves.
**Insight:** When a factory accepts caller-supplied router/factory addresses, check whether the returned pair is validated against the token actually created; any unvalidated pair pointer plus a transferPair-style function lets an attacker redirect held LP tokens to a pair they can burn.