# TINU reflection token deliver() enables pair balance manipulation

TINU reflection token's deliver() function let attacker inflate pair balance, skim excess, and drain 22 ETH via repeated deliver/skim/swap.

- Payout: Real-world hack
- Severity: high
- Program: - TINU
- Analysis by: DeFiHackLabs
- Disclosed: 2023-01-26
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-01/TINU_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230126-tinu
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** reflectiveERC20 token and UniswapV2 pair
**Root cause:** The deliver() function in the reflection token allows arbitrary token burning/redistribution without updating the Uniswap pair's internal reserves, enabling balance inflation and skimming.
**Steps:**
1. Flash loan 104.85 WETH from Balancer.
2. Swap WETH for TINU via Uniswap router, transferring large fees to the TINU-WETH pair.
3. Call `TINU.deliver(TINU.balanceOf(address(this)))` to give away TINU, inflating pair balance.
4. Call `TINU_WETH.skim(address(this))` to extract excess TINU from the pair.
5. Repeat deliver and skim to further manipulate.
6. Swap remaining TINU for WETH from the pair, draining WETH.
7. Repay flash loan and keep profit.
**How found:** Likely identified that deliver() allows arbitrary token redistribution without syncing pair reserves, enabling balance manipulation.
**Exploitation:** Attacker used Balancer flash loan to acquire WETH, swapped for TINU to generate fees for the pair, then repeatedly called deliver() to inflate pair balance and skim() to extract TINU, finally swapping TINU for WETH to drain the pair.
**Insight:** Reflection tokens with deliver() or similar burn functions can be abused to manipulate AMM pair balances if reserves are not synced, allowing skimming and draining.