# BabyDogeCoin FarmZAP: missing slippage protection enables pool manipulation

BabyDogeCoin FarmZAP lacked slippage protection, letting an attacker flash-loan WBNB, manipulate the BABYDOGE/WBNB pool, and drain ~$135k via a crafted deposit/withdraw sequence.

- Payout: Real-world hack
- Severity: high
- Program: BabyDogeCoin
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-29
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/BabyDogeCoin_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230529-babydogecoin
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** FarmZAP contract and BABYDOGE/WBNB PancakeSwap pair
**Root cause:** FarmZAP.buyTokensAndDepositOnBehalf accepted amountOutMin=0 and performed swaps without slippage checks, allowing an attacker to manipulate the BABYDOGE/WBNB pool and force unfavorable trades.
**Steps:**
1. Flash-loan 80,000 WBNB from Radiant.
2. Call `FarmZAP.buyTokensAndDepositOnBehalf{value: 80_000 ether}(IFarm(address(this)), 80_000 * 1e18, 0, path)` with path WBNB->BABYDOGE and amountOutMin=0.
3. In `stakeToken()`, return BABYDOGE for first two calls and WBNB for third to control FarmZAP's token handling.
4. Manipulate the PancakeSwap pair by transferring large amounts of BABYDOGE/WBNB and calling `Pair.swap` to skew reserves.
5. Trigger FarmZAP to sell BABYDOGE and add liquidity by transferring 1 wei BABYDOGE from FarmZAP to itself.
6. Swap WBNB back to BABYDOGE in PancakeSwap to further manipulate reserves.
7. Call `FarmZAP.buyTokensAndDepositOnBehalf` again with 0.001 WBNB to deposit and then withdraw BABYDOGE from FarmZAP.
8. Repay flash loan and keep remaining WBNB as profit.
**How found:** Likely identified that FarmZAP's buyTokensAndDepositOnBehalf used amountOutMin=0 and that the contract's stakeToken logic could be manipulated by an attacker-controlled farm contract, enabling pool manipulation.
**Exploitation:** Attacker flash-loaned 80k WBNB, deposited into FarmZAP with zero slippage, manipulated the BABYDOGE/WBNB PancakeSwap pair via large swaps, triggered FarmZAP's internal sell/addLiquidity logic, then swapped back and withdrew, netting ~$135k.
**Insight:** When a contract accepts a user-supplied farm and calls stakeToken() on it, an attacker can return arbitrary tokens to control which asset the contract treats as its stake token, then combine with zero-slippage swaps to drain funds.