# Sheep: burn function drains pair via reflection token sync

Sheep reflection token's burn function allowed attacker to burn tokens held by the pair, then sync to inflate price and drain ~$3K via flash loan.

- Payout: Real-world hack
- Severity: medium
- Program: - Sheep
- Analysis by: DeFiHackLabs
- Disclosed: 2023-02-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-02/Sheep_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230210-sheep
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP20 reflection token contract and PancakeSwap pair
**Root cause:** The burn function in the reflection token contract allows any caller to burn tokens from any address, including the liquidity pair. Burning tokens from the pair reduces the pair's token balance, and calling sync() updates the reserves, inflating the token price.
**Steps:**
1. Flash loan 380 WBNB from DODO.
2. Swap WBNB for SHEEP via PancakeSwap router.
3. While SHEEP.balanceOf(pair) > 2, call SHEEP.burn(SHEEP.balanceOf(address(this))) to burn attacker's SHEEP, which also burns from the pair due to reflection mechanics.
4. Call Pair.sync() to update reserves after pair's SHEEP balance is reduced.
5. Swap remaining SHEEP back to WBNB at inflated price.
6. Repay flash loan and keep profit.
**How found:** Likely identified that the burn function was callable by anyone and that burning tokens from the pair could manipulate reserves when combined with sync().
**Exploitation:** Attacker used a DODO flash loan of 380 WBNB to buy SHEEP, then repeatedly burned their SHEEP balance. The burn function also reduced the pair's SHEEP balance (likely due to reflection token mechanics where burning from one address affects total supply and thus all balances). After burning enough, calling sync() updated the pair's reserves to reflect the lower SHEEP balance, making SHEEP more expensive. Selling the remaining SHEEP yielded more WBNB, netting ~$3K profit.
**Insight:** For reflection tokens, check if burn or similar functions can be called on arbitrary addresses, especially the liquidity pair, and whether sync() can be used to lock in manipulated reserves.