# FDP reflection token deliver() drains Uniswap pair

FDP reflection token's deliver() inflated pair balance, allowing attacker to swap for nearly all WBNB via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: - FDP
- Analysis by: DeFiHackLabs
- Disclosed: 2023-02-06
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-02/FDP_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230206-fdp
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** reflective ERC20 token and Uniswap V2 pair
**Root cause:** The deliver() function in the reflection token incorrectly updates the pair's balance without syncing, allowing an attacker to inflate the pair's token balance and then swap for WBNB.
**Steps:**
1. Flash loan 16.32 WBNB from DPP.
2. Approve router to spend WBNB and FDP.
3. Swap 16.32 WBNB for FDP via router.swapExactTokensForTokensSupportingFeeOnTransferTokens.
4. Call FDP.deliver(28463.16 ether) to inflate FDP balance of the pair.
5. Call FDP_WBNB.swap(0, WBNB.balanceOf(pair) - 0.15 ether, attacker, '') to drain WBNB.
6. Repay flash loan and keep profit.
**How found:** Likely identified that the reflection token's deliver() function could be called externally to manipulate the pair's balance without a corresponding sync, enabling a price manipulation attack.
**Exploitation:** Attacker flash-loaned 16.32 WBNB, swapped for FDP, then called deliver() to artificially increase the pair's FDP balance. This allowed them to swap a small amount of FDP for almost all WBNB in the pair, netting ~16 WBNB profit.
**Insight:** Reflection tokens with external deliver() functions can be abused to inflate pair balances; check if deliver() updates balances without syncing the pair.