Why Your Burn Function Can Be Weaponized

A classic attack where a malicious contract calls back into the burn function before its state updates are finalized. This exploits the lack of checks-effects-interactions pattern.

• Attack Vector: Attacker burns tokens, receives a callback, then re-executes the burn before balance is deducted.
• Real-World Impact: Can drain millions in underlying assets from staking or rebasing contracts linked to burn mechanics.
• The Fix: Implement reentrancy guards (OpenZeppelin) and strictly adhere to the CEI pattern for all state changes.

Burns that rely on external price feeds (e.g., for algorithmic stablecoins like Terra/Luna) can be gamed. Attackers manipulate the oracle price to trigger disadvantageous burns for other users.

• Attack Vector: Flash loan to skew DEX price, forcing the protocol to burn collateral at a fabricated, unfavorable rate.
• Systemic Risk: Leads to death spirals where forced burns deplete reserves, collapsing the peg.
• The Fix: Use decentralized oracle networks (Chainlink, Pyth) with time-weighted average prices (TWAPs) and circuit breakers.

Burns governed by a multi-sig or admin key become a censorship tool. Founders or regulators can selectively burn user funds by upgrading the contract or calling a privileged function.

• Attack Vector: A compromised or malicious admin key calls burnFrom on any address, violating the immutability promise.
• Erosion of Trust: Turns a deflationary mechanism into a rug pull vector, destroying billions in perceived value.
• The Fix: Use immutable, non-upgradable contracts or time-locked, decentralized governance (e.g., Compound, Uniswap style).

Burns that confer benefits (e.g., fee redistribution, lottery tickets) create profitable MEV opportunities. Bots frontrun user burn transactions to capture the value.

• Attack Vector: Searchers monitor the mempool for burn transactions, sandwiching them to extract the deflationary premium.
• User Impact: Regular users get worse execution prices, negating the economic benefit of burning.
• The Solution: Implement batch processing or commit-reveal schemes like those used by CowSwap and UniswapX to mitigate frontrunning.

Flawed burn logic can sometimes increase the total supply. This occurs when the contract fails to properly validate inputs or update internal accounting, creating tokens from thin air.

• Attack Vector: Passing overflow/underflow values or exploiting rounding errors in rebasing tokens to mint unlimited supply.
• Protocol Killer: Instantly destroys tokenomics, leading to hyperinflation and a $0 valuation.
• The Fix: Use SafeMath libraries, comprehensive unit tests, and formal verification for all arithmetic operations.

Burns on one chain to mint on another (e.g., LayerZero, Wormhole bridges) rely on external validators. Compromising the validator set allows attackers to mint tokens without a corresponding burn.

• Attack Vector: A 51% attack on the validator network or a malicious multisig signs fraudulent mint messages.
• Cross-Chain Contagion: Creates uncollateralized assets on the destination chain, breaking the 1:1 peg and causing panicked selling.
• The Solution: Opt for battle-tested, decentralized bridge security models with fraud proofs or light client verification.

Using address(0) as a privileged actor for mint/burn permissions creates a single point of failure. This pattern, seen in early ERC-20 implementations, is fundamentally flawed.

• Attack Vector: A compromised admin key or a governance deadlock bricks the entire token.
• Correct Pattern: Use a dedicated, upgradeable role manager (e.g., OpenZeppelin's AccessControl).
• Audit Focus: Flag any logic where address(0) or a hardcoded address is used for authorization.

Burning a percentage of every transfer to create deflation is a popular but dangerous mechanic. It can be weaponized via flash loans or MEV bots to drain liquidity.

• Weaponization: A bot can execute a $100M flash loan transfer, triggering a 5% burn ($5M) sent to a dead address, permanently removing value from all holders.
• Liquidity Impact: Concentrates token supply and can destabilize AMM pools like Uniswap V3.
• Safer Alternative: Use a fee collector address with clear governance, or implement a buyback-and-burn via treasury.

In cross-chain bridges (e.g., LayerZero, Axelar), burning on one chain to mint on another introduces settlement risk. If the mint fails, the burn is irreversible.

• Weaponization: An attacker can exploit a race condition or oracle failure to burn assets without a corresponding mint, creating permanent imbalance.
• Systemic Risk: Affects $10B+ in bridged TVL. Protocols like Stargate and Across use lock-mint models or optimistic verification to mitigate.
• Builder Mandate: Implement a pause mechanism for the burn function and robust state reconciliation.

Burn functions that alter total supply can be used to manipulate Time-Weighted Average Price (TWAP) oracles and governance voting power.

• Attack Path: A whale executes a large burn, artificially reducing supply to inflate the price/TVL ratio on oracles like Chainlink, then borrows excessively against the inflated collateral.
• Governance Impact: Burns can concentrate voting power among remaining holders, enabling governance attacks.
• Mitigation: Use supply-adjusted oracles or implement a timelock/delay on large burn transactions.

ERC-777 and ERC-1155 tokens with burn hooks can force token holders into expensive callback executions, leading to gas griefing and DoS.

• Mechanism: An attacker burns tokens sent to a contract, triggering the contract's tokensBurned hook. If the hook logic is complex or reverts, it can brick transfers.
• Historical Precedent: Similar to the ERC-777 reentrancy issues that impacted Uniswap and other DEXs.
• Auditor Check: Scrutinize any _beforeTokenTransfer or hook logic in burn functions for external calls and gas limits.

Using burns to counteract inflation from staking rewards or emissions is often economically naive. It creates predictable sell pressure from validators/miners that can be front-run.

• Economic Attack: MEV searchers can predict the daily sell-off from validators covering costs, short the token, and profit from the burn's ineffective price support.
• Real-World Data: Projects like EIP-1559 (Ethereum) show burns stabilize fees but don't guarantee price appreciation against market forces.
• Design Principle: Burns should not be a primary tokenomics driver. Pair with sustainable treasury revenue and value accrual mechanisms.