Fire Token Hack

On October 1, 2024, the FireToken smart contract was exploited within 24 seconds of its launch, leading to an attacker profiting around $24,000. The vulnerability lay in its token-burning mechanism, which allowed manipulation of the Uniswap liquidity pool's balance.

The root cause of the exploit stemmed from the FireToken contract's implementation of a token-burning mechanism during transfers. The contract's _transfer() function removed a portion of FireTokens from the circulating supply and sent them to a burn address, reducing the liquidity pool's token reserves. Each time a transfer occurred, the function immediately called sync() to update the Uniswap pool's reserves.

This setup allowed the attacker to reduce FireToken reserves while keeping the ETH reserves constant. By decreasing FireToken reserves, the attacker created a price discrepancy in line with Uniswap’s constant product formula (x * y = k), making ETH appear more valuable relative to the dwindling FireTokens.

Exploit tx:

https://etherscan.io/tx/0xd20b3b31…76ff2b