# BIGFI reflection token burn deflates pair, drains $30k

BIGFI reflection token's burn() let attacker deflate the pair's balanceOf to 1, then sync() and dump for ~$30k profit.

- Payout: Real-world hack
- Severity: high
- Program: - BIGFI
- Analysis by: DeFiHackLabs
- Disclosed: 2023-03-22
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-03/BIGFI_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230322-bigfi
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 reflection/deflation token and its PancakeSwap pair
**Root cause:** Reflection token accounting lets burn() reduce the pair's balanceOf() to near 1 by burning a computed amount of _tTotal, desyncing the pair's cached reserves from actual balances.
**Steps:**
1. Flash loan 200,000 USDT from swapFlashLoan `0x28ec0B36F0819ecB5005cAB836F4ED5a2eCa4D13`.
2. Swap USDT to BIGFI via PancakeSwap router `0x10ED43C718714eb63d5aA57B78B54704E256024E`.
3. Compute `burnAmount = BIGFI.totalSupply() - 2 * (BIGFI.totalSupply() / BIGFI.balanceOf(address(Pair)))` and call `BIGFI.burn(burnAmount)`.
4. Call `Pair.sync()` to update reserves to the deflated balance.
5. Swap BIGFI back to USDT via router and repay flash loan plus fee.
**How found:** Recognized the reflection-token burn/sync pattern previously exploited against FDP, TINU and SHEEP; derived the burn amount algebraically from the reflection balance formula to force pair balanceOf to 1.
**Exploitation:** Flash-loaned USDT, bought BIGFI, burned a computed amount to collapse the pair's BIGFI balanceOf to ~1, synced reserves, then sold BIGFI back at the manipulated price, repaying the loan and keeping ~$30k.
**Insight:** On reflection/deflation tokens, burn() and sync() together let you arbitrarily rewrite a pair's reserve ratio; derive the burn amount from the _rOwned/_tTotal formula to force balanceOf(pair) to a tiny value before syncing.