# Axioma presale: buyToken price arbitrage drains WBNB

Axioma presale buyToken allowed buying tokens at fixed presale price, then selling on PancakeSwap for profit, netting ~21 WBNB via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: Axioma
- Analysis by: DeFiHackLabs
- Disclosed: 2023-04-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-04/Axioma_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230424-axioma
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan

**Target:** AxiomaPresale contract and AXT/WBNB PancakeSwap pair
**Root cause:** The presale contract's buyToken function allowed purchasing AXT at a fixed presale rate without any cap or restriction, while AXT was already tradable on PancakeSwap at a higher price, enabling arbitrage.
**Steps:**
1. Flash loan 32.5 WBNB from DODO wbnb-usdt pool.
2. Withdraw WBNB to BNB via `WETH(wbnb).withdraw(flashLoanAmount)`.
3. Call `IAxiomaPresale(axiomaPresale).buyToken{value: flashLoanAmount}()` to buy AXT at presale price.
4. Approve PancakeSwap router to spend AXT and swap all AXT for WBNB via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
5. Repay flash loan and keep remaining WBNB as profit.
**How found:** Likely noticed that the presale contract allowed unlimited buys at a fixed price while AXT had a liquid PancakeSwap pair, creating a price discrepancy.
**Exploitation:** Attacker flash-loaned 32.5 WBNB, converted to BNB, bought AXT at presale price, sold AXT on PancakeSwap for WBNB at market price, repaid loan, and kept ~21 WBNB profit.
**Insight:** Check if presale or token sale contracts have a fixed price and no purchase limits, especially when the token is already trading on DEXes; this creates an arbitrage opportunity that can be amplified with flash loans.