# LPC: self-transfer mints balance via broken _transfer accounting

LPC token's _transfer credited recipientBalance without debiting sender, so self-transfers minted balance; attacker flash-loaned LPC, inflated holdings, repaid and cashed out 178 BNB.

- Payout: Real-world hack
- Severity: high
- Program: LPC
- Analysis by: DeFiHackLabs
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-07/LPC_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220725-lpc
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token contract transfer/_transfer logic on BSC
**Root cause:** _transfer updated the recipient's balance directly (recipientBalance) instead of debiting the sender and crediting the recipient, and never checked sender != recipient, so a self-transfer increased the caller's balance out of thin air.
**Steps:**
1. Flash-loan 1,353,900 LPC from the PancakeSwap LPC/USDT pair via `swap(borrowAmount, 0, address(this), data)` with borrowAmount = reserve - 1
2. In the pancakeCall callback, call `IERC20(LPC).transfer(address(this), LPC_balance)` repeatedly (10 iterations) to self-transfer the full balance
3. Each self-transfer inflates the attacker's LPC balance because _transfer only adds to recipientBalance
4. Repay the flash loan: `IERC20(LPC).transfer(pancakePair, paybackAmount)` where paybackAmount = amount0/90/100*10_000
5. Swap the inflated LPC to BUSD/USDT, then to BNB and exit
**How found:** Public analysis (Beosin/ChainSec monitoring) identified that the _transfer function modified recipientBalance directly rather than updating ledger balances, making self-transfers profitable; the attacker evidently spotted the same missing sender-debit in the token's transfer logic.
**Exploitation:** Attacker contract 0xcfb7909b7eb27b71fdc482a2883049351a1749d7 flash-borrowed nearly the entire LPC reserve from the PancakeSwap pair, looped self-transfers to inflate its LPC balance, repaid the loan plus 10% fee, and swapped the surplus LPC for BUSD then BNB, netting 178 BNB (~$45,715). Project lost 845,631,823 LPC.
**Escalation:** Amplified a single accounting bug with a flash loan of the full pool reserve, letting the minted balance be converted to real value in one atomic transaction.
**Insight:** On forked/low-quality BEP-20 tokens, read _transfer/_mint internals for balance writes that bypass sender debits; a self-transfer (sender == recipient) is the cheapest probe for double-credit accounting bugs, and any such bug is monetizable atomically with a flash loan of the token's own pool reserve.