# BUNN: deliver function drains PancakeSwap pair balance

BUNN reflection token's deliver function reduced PancakeSwap pair's BUNN balance, allowing attacker to swap and profit ~52 BNB.

- Payout: Real-world hack
- Severity: high
- Program: BUNN
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-21
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06//BUNN_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230621-bunn
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** BUNN token contract and PancakeSwap pair
**Root cause:** The deliver function in the BUNN reflection token reduces the token balance of a specified address (the PancakeSwap pair) without transferring tokens, manipulating the pair's reserves.
**Steps:**
1. Call `Bunn_Wbnb_Poll.swap(44 ether, 1_000_000_000_000, address(this), "0x0")` to initiate a flash swap of 44 WBNB.
2. In the pancakeCall callback, call `BUNN.deliver(990_000_000_000)` to decrease the pair's BUNN balance.
3. Repay the flash loan and keep the profit; repeat with `swap(8 ether, ...)` for additional profit.
**Exploitation:** Attacker used PancakeSwap flash swaps to borrow WBNB, then called BUNN.deliver to reduce the pair's BUNN balance, causing a price imbalance. By swapping back, the attacker extracted ~52 BNB profit.
**Insight:** Reflection tokens with functions that arbitrarily reduce balances (like deliver) can be exploited to manipulate AMM pair reserves; check for functions that alter balances without transfers.