# Unverified6883: fake Uniswap callback drains WETH

Unverified contract trusted a UniswapV2 callback from an attacker-created fake pair, letting the attacker drain ~$1,006.89 in WETH.

- Payout: Real-world hack
- Severity: medium
- Program: Unverified6883
- Credited: DeFiHackLabs
- Disclosed: 2025-07-26
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/Unverified6883_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250726-unverified6883
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** UniswapV2-style callback handler on an unverified contract
**Root cause:** Victim contract accepted a swap callback from an arbitrary freshly-created fake pair and transferred WETH to it without verifying the caller/pair legitimacy.
**Steps:**
1. Flash-swap 0.1 WETH from real DAI/WETH pair `0xA478...eB11`
2. In callback, `createPair(TEMP_TOKEN, WETH)` to make fake pair `0x986a...c2d9`
3. Seed fake pair with 100 fake tokens + 0.1 WETH, `sync()`
4. Call `TEMP_PAIR.swap(1 ether, 0, VICTIM, craftedCallbackData)` so victim receives callback
5. Victim transfers ~0.269 WETH to fake pair as payment
6. `sync()` fake pair, dump 999,999,900 fake tokens, swap out 0.3679 WETH
7. Repay flash loan 0.1003 WETH, keep 0.2676 WETH profit
**Exploitation:** Attacker flash-borrows WETH, creates a fake token/pair, invokes the victim's UniswapV2 callback with crafted ABI-encoded data so the victim pays WETH into the attacker-controlled pair, then manipulates fake-pair reserves to withdraw WETH and repay the flash loan, keeping the surplus.
**Insight:** Unverified contracts that implement UniswapV2 callbacks without checking `msg.sender` against a known factory-derived pair can be tricked by attacker-created pairs; craft the callback ABI to match the victim's expected struct layout.