# Starlink: repeated skim/sync drains BSC liquidity pair

Starlink token's fee-on-transfer/skim logic on a BSC PancakeSwap pair let an attacker flash-loan WBNB and repeatedly skim the pair for ~$12k.

- Payout: Real-world hack
- Severity: medium
- Program: - Starlink
- Analysis by: DeFiHackLabs
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-02/Starlink_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230217-starlink
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** BSC PancakeSwap V2 pair for Starlink/WBNB token
**Root cause:** The Starlink token's transfer behavior combined with the pair's skim/sync allowed an attacker to repeatedly extract value from the pair by donating tokens and skimming, without the pair accounting for the fee-on-transfer token mechanics.
**Steps:**
1. Flash-loan WBNB from DODO dodo1, repay by chaining dodo2 and dodo3 flash loans.
2. Swap WBNB into Starlink via the pair, setting `values[1] = Starlink.balanceOf(address(Pair)) * 51 / 100` and calling `Pair.swap(values[1], 0, address(this), "")`.
3. Loop while `Starlink.balanceOf(address(Pair)) > 1000`: `Starlink.transfer(address(Pair), Starlink.balanceOf(address(Pair)))`, then `Pair.skim(address(this))`, then `Pair.sync()`.
4. Swap accumulated Starlink back to WBNB via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
5. Repay flash loans and keep profit.
**Exploitation:** Attacker flash-loaned WBNB across three DODO pools, swapped into the Starlink/WBNB pair, then repeatedly donated Starlink to the pair and called skim/sync to extract WBNB each iteration, finally swapping Starlink back to WBNB and repaying the loans.
**Insight:** On fee-on-transfer or rebasing tokens, a pair's skim/sync can be abused: donating tokens then skimming lets you repeatedly extract the other side of the pair if the token's transfer accounting diverges from the pair's reserves.