# EHX: lack of slippage control enables pool drain

EHX token on BSC lacked slippage control in its swap logic, allowing an attacker to manipulate the pool via repeated skim calls and drain funds.

- Payout: Real-world hack
- Severity: high
- Program: EHX
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-15
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/EHX_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231115-ehx
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high vuln:business-logic vuln:oracle-manipulation

**Target:** EHX token contract on BSC
**Root cause:** The EHX token contract's swap function did not enforce slippage limits, allowing an attacker to manipulate the price by repeatedly transferring tokens to the pair and calling skim.
**Steps:**
1. Flash loan 5.589 WBNB from DPPOracle.
2. Approve and swap WBNB to EHX via PancakeSwap router.
3. Repeatedly transfer EHX to the EHX-WBNB pair and call skim to manipulate reserves.
4. Swap accumulated EHX back to WBNB.
5. Repay flash loan and keep profit.
**Exploitation:** Attacker used a flash loan to obtain WBNB, swapped to EHX, then in a loop transferred EHX to the liquidity pair and called skim, which forced the pair to update reserves without proper slippage checks, inflating the attacker's EHX balance. Finally swapped EHX back to WBNB for profit.
**Insight:** When a token's transfer or skim function interacts with AMM pairs, check if repeated skim calls can manipulate reserves without slippage protection, especially if the token contract lacks minimum output checks.