# StakeOnMe: owner-wrapper mint/burn cycle drains JAKE reserve

StakeOnMe JAKE owner wrapper mint/burn cycle paid out more ETH than mint cost, draining 0.28 ETH reserve via 80 cycles.

- Payout: Real-world hack
- Severity: medium
- Program: StakeOnMe
- Credited: DeFiHackLabs
- Disclosed: 2026-03-15
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/unverified_237d_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260315-unverified-237d
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** JAKE meToken owner wrapper contract on Ethereum
**Root cause:** The owner-privileged wrapper's burn path pays out ETH based on a value that exceeds the raw mint cost, allowing a mint-then-burn cycle to extract reserve ETH.
**Steps:**
1. Flash loan 1.5 WETH from Balancer Vault (zero fee).
2. Unwrap WETH to ETH via `WETH.withdraw(1.5 ether)`.
3. For each cycle: call wrapper payable mint with `0.025/0.01/0.005 ETH`, receive JAKE, call `0xcfd26d5d` pre-burn selector, then `burn(mintedAmount)` to receive ETH.
4. Repeat 40+30+10 cycles to accumulate profit.
5. Rewrap debt WETH, repay Balancer, sweep ETH profit to attacker.
**How found:** Attacker likely observed that the JAKE meToken owner was an unverified public wrapper and that its burn function, callable by the owner, paid out ETH; testing mint/burn cycles revealed a positive value delta.
**Exploitation:** Attacker flash-borrowed 1.5 WETH, unwrapped to ETH, then repeatedly minted JAKE through the owner wrapper's payable path and immediately burned the minted JAKE via the same wrapper. Each cycle returned more ETH than the mint cost, draining the wrapper's pool balance over 80 cycles. Profit repaid the zero-fee flash loan and netted 0.28 ETH.
**Insight:** When a token's owner is a wrapper contract with public mint/burn functions, check whether burn payout exceeds mint cost; even small per-cycle deltas can be amplified with flash-loan-funded loops.