# DFS: insufficient validation enables flash-loan price manipulation

DFS token contract on BSC lacked validation, allowing a flash-loan attacker to manipulate the DFS/USDT PancakeSwap pair and skim ~$1,450.

- Payout: Real-world hack
- Severity: medium
- Program: - DFS
- Analysis by: DeFiHackLabs
- Disclosed: 2022-12-30
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-12/DFS_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20221230-dfs
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm vuln:business-logic vuln:flash-loan

**Target:** BSC token contract and PancakeSwap liquidity pair
**Root cause:** The DFS token contract had insufficient validation, allowing an attacker to manipulate the DFS/USDT PancakeSwap pair's reserves and skim funds via repeated sync/skim calls.
**Steps:**
1. Flash loan USDT from USDT_CCDS_LP via `swap(borrowamount, 0, address(this), "0")`.
2. Transfer borrowed USDT to DFS_USDT_LP and call `swap(swapamount, 0, address(this), new bytes(1))` where `swapamount = reserve0beforeswap * 499 / 1000`.
3. Call `DFS_USDT_LP.sync()` to update reserves.
4. Transfer 98% of received DFS back to DFS_USDT_LP.
5. Loop 12 times calling `DFS_USDT_LP.skim(address(DFS_USDT_LP))`, then `DFS_USDT_LP.skim(address(this))`.
6. Transfer 95% of remaining DFS to DFS_USDT_LP.
7. Swap 99.9% of USDT in DFS_USDT_LP back to attacker via `DFS_USDT_LP.swap(0, dfslpusdtamount * 999 / 1000, address(this), new bytes(1))`.
8. Repay flash loan with 0.5% fee: `IERC20(usdt).transfer(address(USDT_CCDS_LP), paybackfee)`.
**Exploitation:** Attacker flash-loaned USDT, manipulated the DFS/USDT pair by swapping and syncing, then repeatedly skimmed excess tokens to drain value, finally swapping back to USDT and repaying the flash loan, netting ~$1,450.
**Insight:** Repeated skim() calls after sync() can extract value when a token contract lacks validation on pair interactions; watch for tokens with non-standard transfer or sync behavior.