# PancakeSwap Logic Error Bugfix Review

PancakeSwap lottery multiClaim lacked duplicate-ticket validation, letting a winner redeem one ticket 255 times for 255x reward, risking $700k.

- Payout: $70,000
- Severity: critical
- Program: PancakeSwap
- Credited: Juno
- Disclosed: 2021-07-03
- Write-up quality: 7/10
- Original: https://immunefi.com/blog/bug-fix-reviews/pancakeswap-logic-error-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-logic-error-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic

**Target:** Lottery.sol multiClaim / LotteryNFT.sol multiClaimReward smart contracts
**Root cause:** multiClaim loops over _tickets checking claim status but marks tickets claimed only after the loop via multiClaimReward, which itself doesn't verify unclaimed status; duplicate ticket IDs in the array each pass the pre-loop check.
**Steps:**
1. Buy a lottery ticket NFT and win any prize tier (match >=2 of 4 numbers from 1-14).
2. Call `multiClaim(_tickets)` passing the same winning ticket ID repeated up to 255 times in the array.
3. Each duplicate passes `require(!lotteryNFT.getClaimStatus(_tickets[i]))` since none are marked claimed until after the loop.
4. totalReward accumulates reward*N; `cake.safeTransfer` pays out the inflated sum.
**How found:** Not described; write-up is post-hoc analysis of the code showing the check-then-act gap between the loop's claim-status check and the post-loop multiClaimReward marking.
**Exploitation:** Attacker needs one winning ticket (any prize tier, not grand prize). Submit a single transaction calling multiClaim with the winning ticket ID duplicated up to block-size limit (~255 times). Reward is multiplied by duplicate count and paid out in CAKE from the contract's ~$700k balance.
**Escalation:** Same bug affected forks: ApeSwap, PantherSwap, Knights DeFi were all vulnerable; Immunefi coordinated disclosure across BSC forks.
**Insight:** In batch-claim loops, check-then-act across an array lets duplicate IDs bypass per-item state checks; always dedupe or mark-claimed inside the loop before computing totals, and audit forked contracts for inherited logic bugs.