# Beauty Chain: integer overflow in batchTransfer mints tokens

Beauty Chain's batchTransfer multiplied _value by receiver count without overflow check, letting attacker mint near-unlimited BEC tokens.

- Payout: Real-world hack
- Severity: critical
- Program: Beauty Chain
- Analysis by: DeFiHackLabs
- Disclosed: 2018-04-22
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2018-04/BEC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20180422-bec
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:accounting-error

**Target:** BEP20/ERC20 token contract batchTransfer function
**Root cause:** batchTransfer computed amount = _value * receivers.length in Solidity 0.4.x without SafeMath, so a large _value overflowed to a small amount while crediting each receiver the full _value.
**Steps:**
1. Call `batchTransfer(receivers, type(uint256).max / 2 + 1)` with two receiver addresses.
2. The multiplication `_value * receivers.length` overflows to a small value, passing the balance check.
3. Each receiver is credited the full `_value`, minting ~2^255 tokens per address.
**Exploitation:** Attacker called batchTransfer with two addresses and _value = 2^255, overflowing the total-cost multiplication so the balance check passed, then received the full _value credited to each address, minting enormous BEC supply.
**Insight:** Pre-0.8 Solidity token contracts using raw arithmetic in batch/multi-transfer loops are prime overflow targets: the check uses the multiplied total while crediting the unmultiplied per-receiver value.

## Proof of concept (copied exactly from the original report)

**batchTransfer call with overflow value**

```
address[] memory receivers = new address[](2);
        receivers[0] = attacker1;
        receivers[1] = attacker2;
        bec.batchTransfer(receivers, type(uint256).max / 2 + 1);
```