# APIG: self-transfer balance inflation drains PancakeSwap pairs

APIG token's self-transfer inflated balances, letting attacker drain ~59.5 ETH and ~72.1k USDT (~$169K) from PancakeSwap pairs on BSC.

- Payout: Real-world hack
- Severity: high
- Program: APIG
- Analysis by: DeFiHackLabs
- Disclosed: 2023-09-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-09/APIG_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230908-apig
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** BEP20 token contract and PancakeSwap liquidity pairs on BSC
**Root cause:** APIG token's transfer logic mishandles self-transfers, inflating the sender's balance each time a transfer is made to the same address.
**Steps:**
1. Flash-swap 500e18 BUSD from pair `0xaDaD973f8920bc511d94aade2762284f621F1467` via `swap(amount,0,address(this),abi.encode(amount))`.
2. In `pancakeCall`, transfer BUSD to pair `0xEFBf31B0Ca397D29E9BA3fb37FE3C013EE32871d` and swap for APIG via router `getAmountsOut`.
3. Loop `APIG.transfer(address(this), transferAmount)` repeatedly until balance exceeds `257_947_240_540_223_703_649_846_558_720`, inflating APIG holdings.
4. Swap inflated APIG into pair `0xEFBf...` for BUSD (`amount72628`), then into pair `0xb920...` for BETH (`amount59500`).
5. Repay flash swap to `0xaDaD` pair with `amount + amount/100*3` BUSD; keep profit.
**How found:** Not stated; likely spotted that APIG's transfer function credits the recipient before debiting the sender, so self-transfers mint balance.
**Exploitation:** Attacker flash-borrowed 500e18 BUSD, used it to acquire APIG, then repeatedly self-transferred APIG to inflate balance, dumped inflated APIG into two PancakeSwap pairs to extract BUSD and BETH, repaid the flash loan plus 3% fee, and kept ~59.5 ETH and ~72.1k USDT.
**Escalation:** Chained flash loan + balance-inflation bug + multi-pair swaps to amplify extraction across two liquidity pools.
**Insight:** When auditing BEP20/ERC20 tokens, test self-transfers and transfers to the token contract itself; a credit-before-debit ordering lets an attacker mint arbitrary balance and dump it into AMM pairs.