# BEVO reflection token deliver() drains WBNB pair

BEVO reflection token's deliver() function allowed attacker to inflate pair reserves and skim WBNB, stealing 144 BNB via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: - BEVO
- Analysis by: DeFiHackLabs
- Disclosed: 2023-01-30
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-01/BEVO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230130-bevo
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** BEP20 reflection token and PancakeSwap pair
**Root cause:** The reflection token's deliver() function burns tokens from the caller's balance and reduces total supply, but the BEVO-WBNB pair's reserves are not updated, allowing an attacker to manipulate the pair's balance and skim excess WBNB.
**Steps:**
1. Flash loan 192.5 WBNB from PancakePair WBNB-USDC via swap(0, 192.5 ether, address(this), new bytes(1)).
2. In pancakeCall callback, approve router to spend WBNB and swap all WBNB for BEVO using swapExactTokensForTokensSupportingFeeOnTransferTokens.
3. Call bevo.deliver(bevo.balanceOf(address(this))) to burn BEVO from attacker's balance, reducing total supply.
4. Call bevo_wbnb.skim(address(this)) to transfer excess BEVO (now worth more WBNB) to attacker.
5. Call bevo.deliver(bevo.balanceOf(address(this))) again to burn the skimmed BEVO.
6. Call bevo_wbnb.swap(337 ether, 0, address(this), "") to swap BEVO for WBNB, draining WBNB from the pair.
7. Repay flash loan by transferring 193 WBNB to the WBNB-USDC pair.
**Exploitation:** Attacker flash-loaned 192.5 WBNB, swapped for BEVO, then used deliver() to burn BEVO and manipulate the BEVO-WBNB pair's reserves. Skimming and swapping extracted 144 BNB profit.
**Insight:** Reflection tokens with a deliver() function that burns tokens without updating AMM pair reserves can be exploited to skew reserve ratios and drain the paired asset.