# 3913Token: deflationary skim/burn loop drains Pancake pairs

Deflationary 3913Token on BSC manipulated via repeated pair.skim and burnPairs to inflate balance, then swapped through Pancake pairs to drain ~$31K BUSD.

- Payout: Real-world hack
- Severity: high
- Program: 3913Token
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-02
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/3913_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231102-3913
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** BEP-20 deflationary token and PancakeSwap pairs on BSC
**Root cause:** Deflationary token's burnPairs and pair.skim interaction lets attacker repeatedly re-inflate token balance held by a helper contract, amplifying reserves in the Pancake pair before swapping out.
**Steps:**
1. Flash-loan BUSD from five DODO pools in nested DPPFlashLoanCall chain
2. Swap 10 BUSD into 3913 and 9419 via Pancake router
3. Deploy helper NewContract, transfer 1 ether 3913 to it, pull back via transferToken
4. Swap large 3913 amount into BUSD, then transfer 1 BUSD + full 3913 balance to pair and call `pair.skim(helper)`
5. Loop 10x: `x.transferToken(3913, this)`, if balance of 0x570C... != 1e15 then transfer 1 BUSD + 3913 to pair and skim; else call `vulnerable.burnPairs()`
6. Swap inflated 3913 to BUSD, then 3913 to 9419 via pair3913to9419 using skim/swap
7. Swap 9419 back to BUSD via router with fee-on-transfer support
8. Repay DODO flash loans
**Exploitation:** Nested DODO flash loans supply BUSD capital; repeated skim/burnPairs cycles inflate 3913 balance held by helper, dumping into Pancake pairs to extract BUSD, then routed through 9419 pair and back to BUSD to repay loans and keep profit.
**Escalation:** Chained five DODO flash loans to maximize capital, then multi-hop through two Pancake pairs (3913/BUSD and 3913/9419) to amplify extraction.
**Insight:** Deflationary tokens with burn/skim hooks can be looped: if burnPairs resets a tracked balance while skim re-syncs reserves, each cycle re-inflates the pair's token reserve — look for tokens exposing burn/skim functions callable by anyone.