# GSS: skim/sync manipulation drains PancakeSwap pools

GSS token skim on PancakeSwap pairs let attacker inflate reserves and drain ~$25K via flash-loan-funded swaps.

- Payout: Real-world hack
- Severity: high
- Program: GSS
- Analysis by: DeFiHackLabs
- Disclosed: 2023-08-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-08/GSS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230824-gss
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** PancakeSwap V2 GSS/USDT and GSS/GSSDAO pairs on BSC
**Root cause:** GSS token balance manipulation combined with skim() on the GSS/USDT pair allowed the attacker to shift reserves and then skim the GSS/GSSDAO pair to extract value.
**Steps:**
1. Flash loan 30,000 USDT from DODO pool `0x9ad32e3054268B849b84a8dBcC7c8f7c52E4e69A`.
2. Swap USDT to GSS via PancakeRouterV2.
3. Transfer `707_162_351_662_098_288_993_328` GSS to gss_usdt_pool `0x1ad2cB3C2606E6D5e45c339d10f81600bdbf75C0`.
4. Call `IPancakePair(gss_usdt_pool).skim(gss_gssdao_pool)` then `sync()`.
5. Call `IPancakePair(gss_gssdao_pool).skim(address(this))` to extract GSS.
6. Swap all GSS back to USDT and repay 30,000 USDT flash loan.
**Exploitation:** Attacker flash-borrowed 30K USDT, bought GSS, dumped GSS into the GSS/USDT pair, skimmed excess to the GSS/GSSDAO pair, synced, then skimmed the GSS/GSSDAO pair to capture GSS and swapped back to USDT for profit.
**Insight:** When a token's transfer behavior lets you push balances into a pair, skim()/sync() can be used to shift reserves between paired pools and extract the difference; check pairs sharing a token for skim-based arbitrage.