# CS Token: stale sellAmount global drains BUSD pair

CS Token's burn calculation used a stale global sellAmount variable, letting an attacker flash-swap BUSD to drain ~714K USD from the BSC pair.

- Payout: Real-world hack
- Severity: high
- Program: CS Token
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-24
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/CS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230524-cs
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:accounting-error vuln:business-logic

**Target:** BEP-20 token contract and PancakeSwap pair on BSC
**Root cause:** The token's burnAmount was computed from an outdated global variable `sellAmount` that was not reset per transaction, so repeated swaps accumulated incorrect burn accounting and mispriced the token.
**Steps:**
1. Flash-swap 80,000,000 BUSD from PancakeSwap pair `0x7EFaEf62fDdCCa950418312c6C91Aef321375A00` via `pair.swap(80_000_000 ether, 0, address(this), bytes("123"))`.
2. In `pancakeCall`, approve router and loop 99 times: `router.swapTokensForExactTokens(5000 ether, BUSD.balanceOf(this), [BUSD,CS], this, deadline)` to repeatedly buy CS and trigger the stale `sellAmount` accounting.
3. Swap remaining BUSD to CS via `swapExactTokensForTokensSupportingFeeOnTransferTokens`, sending output to `0x382e9652AC6854B56FD41DaBcFd7A9E633f1Edd5`.
4. Approve CS and loop: while CS balance >= 3000 ether, `swapExactTokensForTokensSupportingFeeOnTransferTokens(3000 ether, 1, [CS,BUSD], this, deadline)` then `CS.transfer(this, 2)` to keep triggering the burn bug.
5. Repay 80,240,000 BUSD to the pair and keep the profit.
**How found:** Analysis of the token's burn logic revealed `sellAmount` was a global variable not reset between swaps, making burnAmount depend on stale state.
**Exploitation:** Attacker flash-borrowed 80M BUSD from the PancakeSwap pair, used repeated buy/sell cycles against CS to exploit the stale `sellAmount` global so burn amounts were miscomputed, then repaid the flash loan and retained the drained BUSD (~714K USD).
**Escalation:** Looping the swap 99 times and the sell loop amplified the accounting error into a large drain.
**Insight:** In fee-on-transfer/burn tokens, check whether burn or fee amounts derive from contract-level globals that persist across swaps; repeated small swaps can compound stale-state mispricing.