# XAI: public burn() drains Pancake pair via supply manipulation

XAI token's public burn() let attacker flash-loan WBNB, buy XAI, burn nearly all supply, sync the Pancake pair, and dump remaining XAI for profit.

- Payout: Real-world hack
- Severity: high
- Program: XAI
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-15
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/XAI_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231115-xai
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token XAI and its PancakeSwap XAI/WBNB pair on BSC
**Root cause:** XAI.burn() is callable by anyone and reduces totalSupply without adjusting the AMM pair reserves, so burning supply massively inflates the price of the remaining tokens held by the attacker.
**Steps:**
1. Flash-loan WBNB from DPPOracle (0xFeAFe253802b77456B4627F8c2306a9CeBb5d681).
2. Approve PancakeRouter and swap WBNB -> XAI via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
3. Call `XAI.burn(XAI.totalSupply() - 4596)` to burn nearly the entire supply.
4. Call `XAI_WBNB.sync()` to force the pair to update reserves to the new (tiny) XAI balance.
5. Swap all held XAI -> WBNB at the inflated price.
6. Repay the flash loan to DPPOracle.
**Exploitation:** Attacker flash-borrows the DPPOracle's WBNB, buys XAI on PancakeSwap, calls the permissionless burn() to destroy ~all supply, syncs the pair so reserves reflect the burned balance, then sells the remaining XAI back for WBNB at a manipulated price and repays the loan.
**Insight:** Any token exposing a public burn()/mint() that changes totalSupply without touching AMM pair reserves is a price-manipulation primitive: check for permissionless supply-changing functions and whether the pair is synced afterward.