# BambooIA: skim-based price manipulation drains PancakeSwap pair

BambooIA token's skim-based price manipulation let an attacker drain ~200 BNB from the WBNB/BAMBOO PancakeSwap pair via repeated skim calls.

- Payout: Real-world hack
- Severity: high
- Program: BambooIA
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-04
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/Bamboo_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230704-bamboo
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP20 token and PancakeSwap pair
**Root cause:** The BambooIA token's transfer logic or the pair's skim function allowed an attacker to repeatedly manipulate the pair's reserves by transferring small amounts and calling skim, inflating the token price artificially.
**Steps:**
1. Obtain 4000 WBNB via flash loan (mocked with deal).
2. Swap WBNB for BAMBOO using PancakeRouter to acquire tokens.
3. Loop 10,000 times: transfer `1_343_870_967_101_818_317` BAMBOO to the WBNB/BAMBOO pair and call `skim(address(this))`.
4. Swap all BAMBOO back to WBNB via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
5. Repay flash loan and keep profit (~200 BNB).
**How found:** Likely identified that the pair's skim function could be abused with repeated small transfers to distort the price oracle or reserves, enabling profitable arbitrage.
**Exploitation:** Attacker flash-loaned 4000 WBNB, swapped for BAMBOO, then repeatedly transferred tiny BAMBOO amounts to the pair and called skim to extract excess tokens while manipulating reserves, then sold BAMBOO back for WBNB at inflated price, netting ~200 BNB.
**Insight:** Pairs with skim functions and tokens with transfer hooks can be manipulated by repeatedly donating small amounts and skimming, especially if the token's price is derived from pair reserves without TWAP or manipulation resistance.