# DDC token: public handleDeductFee mints balance to pair

DDC token's public handleDeductFee let anyone mint fee tokens to a pair, then sync and dump for profit.

- Payout: Real-world hack
- Severity: high
- Program: DDC
- Analysis by: DeFiHackLabs
- Disclosed: 2022-08-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-08/DDC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20220828-ddc
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic

**Target:** BEP-20 token fee handler and PancakeSwap-style pair on BSC
**Root cause:** handleDeductFee is externally callable with no access control and no validation that the caller is a legitimate fee-deduction path, so it credits arbitrary amounts to an arbitrary user address.
**Steps:**
1. Fork BSC at block 20840079.
2. Swap 0.1 BNB through WBNB->USDT->DDC to acquire DDC.
3. Read pairReserve = DDC.balanceOf(TargetPair) and call `DDC.handleDeductFee(0, pairReserve - 1, address(TargetPair), address(this))` to mint DDC to the pair.
4. Call `TargetPair.sync()` to update reserves to the inflated balance.
5. Sell DDC back through DDC->USDT via the router.
**Exploitation:** Attacker bought a small amount of DDC, invoked the unprotected handleDeductFee to credit ~pairReserve DDC to the pair, synced reserves, then sold the inflated DDC balance into the pool draining USDT.
**Insight:** Token fee-handler functions that take a 'user'/'from' address and a fee amount are prime targets: if callable externally they let you mint balance to any address, and pairing that with pair.sync() converts it to instant pool drain.