# ThoreumFinance: self-transfer balance inflation drains BNB liquidity

ThoreumFinance token's transfer logic inflated balances when self-transferring, letting an attacker mint tokens and swap them for ~2000 BNB.

- Payout: Real-world hack
- Severity: high
- Program: - ThoreumFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2023-01-19
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-01/ThoreumFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230119-thoreumfinance
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC20 token contract (Thoreum) on BSC
**Root cause:** The token's transfer function incorrectly updates balances when sender and recipient are the same address, causing the balance to increase with each self-transfer.
**Steps:**
1. Acquire a small amount of THOREUM tokens via PancakeSwap (e.g., swap 0.003 BNB).
2. Call `THOREUM.transfer(address(this), THOREUM.balanceOf(address(this)))` in a loop 15 times to inflate the balance.
3. Approve PancakeSwap router to spend THOREUM and swap the inflated tokens for WBNB, repeating until balance is drained.
**How found:** Likely discovered by analyzing the token's transfer logic and noticing that self-transfers incorrectly increase balance.
**Exploitation:** Attacker obtained a tiny amount of THOREUM, then repeatedly self-transferred to multiply the balance, and swapped the inflated tokens for WBNB on PancakeSwap, extracting ~2000 BNB total (6 BNB in the referenced tx).
**Insight:** Check ERC20 transfer implementations for incorrect balance updates when from == to; such self-transfer bugs can lead to infinite minting.