# DDCoin Marketplace: sellItem loop drains BUSDT via flash loan

DDCoin Marketplace allowed repeated sellItem calls to drain BUSDT via flash-loan-funded price manipulation and order-limit bypass.

- Payout: Real-world hack
- Severity: high
- Program: DDCoin
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-01
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/DDCoin_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230601-ddcoin
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan

**Target:** DDCoin Marketplace contract on BSC
**Root cause:** Marketplace.sellItem allowed selling items repeatedly without properly updating state or limiting order frequency, enabling an attacker to loop sellItem and drain BUSDT via allowance.
**Steps:**
1. Flash loan BUSDT from multiple DPPOracle pools in sequence.
2. Approve BUSDT and DD to Marketplace and Router.
3. Call `MarketPlace.listItem(500e18, addrToInvite)` to place an order.
4. Deploy HelperContract and transfer 500e18 BUSDT to it; call `placeOrder()` to bypass 'only one order per hours' limit.
5. Loop 100 times: read `MarketPlace.items(MarketPlace.currenyId())` to get totalAmount; swap BUSDT to DD via Router using `swapTokensForExactTokens(totalAmount/20, ...)`; call `MarketPlace.sellItem(totalAmount)`; then `BUSDT.transferFrom(address(MarketPlace), address(this), BUSDT.allowance(address(MarketPlace), address(this)))` to extract BUSDT.
6. Repay flash loans.
**Exploitation:** Attacker flash-loaned BUSDT, placed a listing, bypassed order limit with a helper contract, then repeatedly swapped small BUSDT to DD and sold large amounts via sellItem, draining BUSDT from the Marketplace via allowance.
**Insight:** When a marketplace allows selling items and pulling payment via allowance, check if sellItem can be called repeatedly without state reset or cooldown; order-limit bypass via helper contracts is a common pattern.