# HCT: burn function enables PancakeSwap price manipulation

HCT token burn function allowed attacker to repeatedly burn 80% of balance, manipulating PancakeSwap pair price for profit.

- Payout: Real-world hack
- Severity: high
- Program: HCT
- Analysis by: DeFiHackLabs
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-09/HCT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230907-hct
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:flash-loan vuln:oracle-manipulation

**Target:** HCT token and PancakeSwap pair
**Root cause:** HCT token's burn function burns 80% of caller's balance, reducing total supply and thus increasing token price on the PancakeSwap pair.
**Steps:**
1. Flash loan 2200 WBNB from DPPOracle.
2. Swap WBNB to HCT via PancakeRouter.
3. Repeatedly call `HCT.burn(HCT.balanceOf(address(this)) * 8 / 10 - 1)` until balance <= 70.
4. Call `PancakePair.sync()` to update reserves after burn.
5. Swap remaining HCT back to WBNB.
6. Repay flash loan.
**Exploitation:** Attacker flash-loaned 2200 WBNB, bought HCT, burned most of it to inflate price, synced the pair, then sold remaining HCT for more WBNB, repaying loan and keeping profit (~30.5 BNB).
**Insight:** Tokens with burn functions that reduce supply can be manipulated to inflate price on AMM pairs; check for burn/sync patterns in token contracts.