# BGLD: repeated migrate() enables flash-loan pool manipulation drain

BGLD deflationary token's migrate() could be called repeatedly, letting an attacker flash-loan and manipulate old/new BGLD pools to drain ~$18k.

- Payout: Real-world hack
- Severity: high
- Program: - BGLD (Deflationary token)
- Analysis by: DeFiHackLabs
- Disclosed: 2022-12-12
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-12/BGLD_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20221212-bgld
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 deflationary token migrate() proxy and PancakeSwap/DODO pools
**Root cause:** The migrate() function on the ERC proxy could be invoked repeatedly by anyone, converting oldBGLD to newBGLD at a manipulable rate, and the deflationary token's skim/sync behavior on its liquidity pairs let reserves be skewed cheaply.
**Steps:**
1. Flash-loan 125 WBNB from DODO.
2. Swap WBNB into oldBGLD on WBNB_oldBGLD pair, then donate `oldBGLD.balanceOf(pair)*10+10` and call `skim`/`sync` to skew reserves.
3. Swap oldBGLD back to WBNB to repay flash loan.
4. Call `Proxy.migrate()` to convert oldBGLD to newBGLD, then swap newBGLD to DEBT.
5. Flash-loan 950e9 DEBT from newBGLD_DEBT pair via `swap(0, 950*1e9, ...)`.
6. In pancakeCall, donate DEBT to oldBGLD_DEBT, `skim`/`sync`, swap oldBGLD out, donate `oldBGLD.balanceOf(pair)*10+10`, `skim`/`sync`, swap oldBGLD to DEBT.
7. Call `Proxy.migrate()` again and swap newBGLD to DEBT, repay DEBT loan.
8. Swap DEBT to USDT and keep profit.
**Exploitation:** Attacker used DODO and PancakeSwap flash loans to fund pool manipulation, repeatedly invoked migrate() to mint newBGLD from cheaply-acquired oldBGLD, and used skim/sync donation tricks on the deflationary token pairs to extract value, netting ~$18k in USDT.
**Escalation:** Chained two flash loans (WBNB then DEBT) with repeated migrate() calls and skim/sync reserve skewing across three pairs.
**Insight:** For deflationary/rebasing tokens, check whether migrate() or similar conversion functions are permissionless and repeatable; combined with skim/sync on their pairs, reserves can be skewed with a small donation to mint value cheaply.