# OLIFE reflection token rate manipulation drains WBNB pair

OLIFE reflection token's rate manipulation via transfer/deliver lowered rSupply/tSupply, inflating pair's reflected balance and letting attacker swap out ~32 WBNB.

- Payout: Real-world hack
- Severity: high
- Program: OLIFE
- Analysis by: DeFiHackLabs
- Disclosed: 2023-04-19
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-04/OLIFE_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230419-olife
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP20 reflection token and PancakeSwap OLIFE/WBNB pair
**Root cause:** Reflection token computes balanceOf as rOwned/rate where rate=rSupply/tSupply; transfer() and deliver() reduce rSupply and tSupply, lowering rate and inflating the pair's apparent OLIFE balance.
**Steps:**
1. Flash loan 969 WBNB from DODO via `flashLoan(969e18,0,address(this),...)`.
2. Swap WBNB to OLIFE through PancakeRouter `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
3. Call `OLIFE.transfer(address(this), balanceOf(this))` 19 times in `loopTransfer(19)` to reduce rSupply/tSupply.
4. Call `OLIFE.deliver(66859267695870000)` to further reduce supplies.
5. Read pair reserves, compute inflated `amountin = balanceOf(pair) - oldReserve`, call `OLIFE_WBNB_LPPool.swap(0, swapAmount, address(this), "")`.
6. Repay 969 WBNB to DODO, keep ~32 WBNB profit.
**How found:** Analysis of reflection-token accounting: rate = rSupply/tSupply and balanceOf = rOwned/rate means any function reducing supplies (transfer, deliver) shifts the pair's apparent balance, enabling reserve mismatch arbitrage.
**Exploitation:** Attacker flash-borrowed 969 WBNB, bought OLIFE, then repeatedly self-transferred and called deliver() to shrink rSupply and tSupply, lowering the reflection rate. Since pair balanceOf = rOwned/rate, the pair's apparent OLIFE balance rose, enabling a swap that extracted WBNB from the pool; loan repaid, ~32 WBNB profit.
**Insight:** On reflection/fee-on-transfer tokens, check every function that mutates rSupply or tSupply (transfer, deliver, reflect) and whether pair balanceOf derived from rOwned/rate can be inflated to desync from actual reserves before a swap.