# ANCH: repeated skim() drains PancakeSwap pair

ANCH token pair on BSC was drained by repeatedly calling skim() after inflating pair balance, then selling ANCH for USDT.

- Payout: Real-world hack
- Severity: high
- Program: ANCH
- Analysis by: DeFiHackLabs
- Disclosed: 2022-08-09
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-08/ANCH_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220809-anch
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan

**Target:** PancakeSwap V2 pair for ANCH/USDT on BSC
**Root cause:** The ANCH token pair's skim() function allowed an attacker to repeatedly extract excess tokens after artificially inflating the pair's balance via direct transfer, without proper accounting.
**Steps:**
1. Flash loan 50,000 USDT from DODO.
2. Swap USDT for ANCH via PancakeSwap router.
3. Transfer all ANCH to the pair contract.
4. Call `Pair.skim(address(Pair))` 60 times to manipulate internal balances.
5. Call `Pair.skim(address(this))` to extract ANCH.
6. Sell ANCH for USDT and repay flash loan.
**Exploitation:** Attacker used a DODO flash loan of 50,000 USDT to buy ANCH, transferred ANCH to the pair, then called skim() repeatedly to drain excess tokens, finally selling ANCH for USDT and repaying the loan.
**Insight:** Repeated skim() calls on a pair can be abused when token transfers directly to the pair inflate balances without syncing reserves, allowing extraction of excess tokens.