# LaEeb: missing slippage protection drained via skim loop

LaEeb token pair lacked slippage protection; attacker flash-loaned 8.6 WBNB, repeatedly transferred LaEeb and skimmed the pair to drain ~1.8 WBNB.

- Payout: Real-world hack
- Severity: medium
- Program: LaEeb
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-30
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/LaEeb_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231030-laeeb
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC PancakeSwap LaEeb/WBNB pair and router swap
**Root cause:** The LaEeb token/pair lacked slippage protection, letting an attacker manipulate the pair balance via direct transfers and skim() to extract value from swaps with zero min-out.
**Steps:**
1. Flash loan 8.6 WBNB from DPP (0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476).
2. Swap WBNB->LaEeb via PancakeSwap router with `amountOutMin=0`.
3. Loop 10x: `LaEeb.transfer(Pair, 3_255_594_269_218 ether)` then `Pair.skim(address(this))`.
4. Swap all LaEeb->WBNB via router with `amountOutMin=0`.
5. Repay 8.6 WBNB flash loan; keep ~1.8 WBNB profit.
**How found:** Attacker likely noticed the LaEeb pair's swap path used amountOutMin=0 and that skim() could be abused after direct token transfers to shift pair reserves.
**Exploitation:** Attacker flash-loaned 8.6 WBNB, bought LaEeb with zero slippage protection, then repeatedly donated LaEeb to the pair and called skim() to harvest excess tokens, finally swapping LaEeb back to WBNB at a manipulated rate and repaying the loan.
**Insight:** When a token pair exposes skim() and swaps are executed with zero min-out, direct transfers to the pair can be used to skew reserves and harvest value via skim in a loop; check router calls for amountOutMin=0.