# WaleCoin: unprotected initialize() enables router takeover and BNB drain

WaleCoin's RewardsChain.initialize() was callable post-deployment, letting an attacker set a malicious router and drain 1.415 BNB via triggerZeusBuyback.

- Payout: Real-world hack
- Severity: high
- Program: WaleCoin
- Credited: DeFiHackLabs
- Disclosed: 2025-06-15
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/WaleCoin_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250615-walecoin
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:access-control vuln:misconfiguration

**Target:** RewardsChain smart contract (proxy implementation)
**Root cause:** The initialize(address) function lacked access control or an initialized guard, allowing anyone to call it after deployment and overwrite critical state including owner, router, pair, allowances, and initial supply receiver.
**Steps:**
1. Deploy an attacker-controlled contract implementing router-like functions (factory, createPair, WETH, swapExactETHForTokensSupportingFeeOnTransferTokens) and a receive() to accept BNB.
2. Call `IRewardsChain(WALE_COIN).initialize(address(attackContract))` to set the malicious router and become owner.
3. Call `IRewardsChain(WALE_COIN).triggerZeusBuyback(WALE_COIN.balance, false)` to trigger the buyback using the contract's BNB balance.
4. The buyback sends BNB to the attacker-controlled router, which forwards it to the attacker.
**How found:** Likely identified by reviewing the contract's initialize function and noticing it lacked access control or an initialized check, allowing anyone to reinitialize the proxy and set a malicious router.
**Exploitation:** Attacker deployed a malicious router contract, called initialize() to set it as the trusted router, then invoked triggerZeusBuyback() with the contract's full BNB balance. The buyback logic transferred the BNB to the malicious router, which forwarded it to the attacker, netting 1.415 BNB (~918.83 USD).
**Insight:** Always check if initialize() functions on upgradeable contracts are protected by an initializer modifier or onlyOwner; missing guards allow anyone to reinitialize and hijack critical state like router addresses.