# TIPMine: permissionless mine() burns pool TIP and drains TIP/SOL pair

TIPMine.mine() was permissionless and burned TIP straight out of the live TIP/SOL pair, collapsing the reserve so the attacker sold held TIP for ~667 SOL.

- Payout: Real-world hack
- Severity: critical
- Program: TIPMine
- Disclosed: 2026-10-17
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-10/TIPMine_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20261017-tipmine
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token mining contract + PancakeV2 TIP/SOL pair on BNB Chain
**Root cause:** mine() has no caller restriction (only a supply flag and a once-per-day timer already satisfied at lastMineTime 0), and it calls TIP.burnFromPool/distributeFromPool which transfer TIP out of the live pair and force-sync reserves, breaking x*y=k.
**Steps:**
1. Fork BSC at block 128188933, one block before attack tx 0xa7b879b5d4252fa5b518db1f81be8a5cc670c5b978c7626fa287c0a1f37895a3.
2. Acquire ~36k SOL working capital (Venus-fork borrow + 13 ecosystem-pool flash loans; modelled with deal() in PoC).
3. Buy a small TIP position: `swapExactTokensForTokensSupportingFeeOnTransferTokens(1 ether, 0, [SOL,TIP], ...)`.
4. Dump 35,121 SOL into the pair to move most TIP onto attacker's side.
5. Call permissionless `TIPMine.mine()` — burns/pushes 2,000,000,000 TIP out of the pair, dropping TIP reserve from 2,000,053,839 to 53,839 while SOL stays 35,837.
6. Sell held TIP back into the repriced pair for nearly the entire SOL reserve.
7. Repay flash loans; net ~667 SOL to attacker EOA.
**How found:** Read verified TIPMine/TIP source: noticed mine() lacked caller restriction and that burnFromPool/distributeFromPool transfer TIP directly out of the live pair then call sync(), breaking the AMM invariant; confirmed on fork that removing the mine() call turns +706 SOL profit into ~31,563 SOL loss.
**Exploitation:** Attacker flash-borrowed ~36k SOL across a Venus-fork borrow and 13 ecosystem pools, bought a little TIP, dumped 35,121 SOL to shift most pool TIP to their side, called ungated mine() to burn the pool's remaining TIP and force-sync (collapsing TIP reserve, repricing TIP ~10^8x), then sold held TIP back for almost the entire SOL reserve, repaying loans and netting 667.228863551156127021 SOL to the EOA.
**Escalation:** Multi-source flash-loan capital stacking (Venus-fork + 13 pools) to fund the 35,121 SOL dump; TIP sell path burns 94% and re-syncs, compounding the reserve corruption.
**Insight:** When a token's mint/burn/distribute helpers touch the LP pair directly and call sync(), check whether the trigger function is permissionless — a single ungated call can collapse one reserve and let you sell into the mispriced pool.