# PLTD: transfer logic flaw drains USDT liquidity pair

PLTD token transfer logic flaw let attacker flash-loan USDT, inflate pair reserves, and skim ~$24k from the PLTD/USDT liquidity pool.

- Payout: Real-world hack
- Severity: high
- Program: PLTD
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/PLTD_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221018-pltd
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic

**Target:** BEP-20 token PLTD and its PancakeSwap V2 USDT pair
**Root cause:** PLTD's transfer logic mishandles balance accounting, allowing an attacker to transfer more PLTD into the pair than legitimately held and then use skim() to extract the excess reserves.
**Steps:**
1. Flash loan `220_000 * 1e18` USDT from DODO dodo1.
2. Inside callback, flash loan `440_000 * 1e18` USDT from dodo2.
3. Swap `660_000 * 1e18` USDT into PLTD via PancakeSwap router.
4. Read `PLTD.balanceOf(address(Pair))` and transfer `amount * 2 - 1` PLTD to the pair.
5. Call `Pair.skim(address(this))` to pull excess tokens.
6. Swap PLTD back to USDT and repay both flash loans.
**Exploitation:** Attacker flash-loaned USDT from two DODO pools, swapped into PLTD, then abused the token's transfer accounting to push `2x-1` PLTD into the pair and called skim() to extract the surplus USDT reserves, netting ~$24k.
**Insight:** When a token's transfer math is suspect, test whether sending more tokens than the pair holds and calling skim() lets you extract the counterpart reserve; flash loans make the capital cost zero.