# UPENG: arbitrary burn distorts Pancake pair reserves, drains WBNB

UPENG token's unprotected burn(address,uint256) let attacker destroy the Pancake pair's UPENG balance, sync reserves, and drain 1.5 WBNB.

- Payout: Real-world hack
- Severity: high
- Program: UPENG
- Credited: DeFiHackLabs
- Disclosed: 2025-07-13
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/UPENGBurnSync_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250713-upengburnsync
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** ERC-20 token with public burn function and PancakeSwap V2 pair
**Root cause:** UPENG exposes a permissionless burn(address,uint256) that lets any caller destroy tokens from any address, including the Pancake pair. The pair's sync() then commits the manipulated token balance as reserves.
**Steps:**
1. Buy UPENG with 0.001 BNB via Pancake router `swapExactETHForTokensSupportingFeeOnTransferTokens`.
2. Call `UPENG.burn(UPENG_WBNB_PAIR, pairUpengBalance - 1)` to reduce pair's UPENG balance to 1 wei.
3. Call `UPENG_WBNB_PAIR.sync()` to update reserves to the distorted low UPENG balance.
4. Transfer bought UPENG to the pair and call `swap(0, wbnbOut, attacker, '')` where wbnbOut is computed via `getAmountOut` against the manipulated reserves.
**How found:** Likely identified the public burn function in unverified UPENG token source and recognized that burning the pair's balance followed by sync() would manipulate reserves for a profitable swap.
**Exploitation:** Attacker flash-funded or seeded with 0.001 BNB, bought UPENG, burned nearly all UPENG held by the pair, synced reserves, then sold the acquired UPENG for 1.5 WBNB profit.
**Insight:** When auditing tokens with burn/mint functions, check if burn accepts an arbitrary address and whether a DEX pair holding that token can be manipulated via sync() to distort reserves before a swap.