# ShibaToken: batchTransferLockToken logic flaw drains pair via flash loan

ShibaToken's batchTransferLockToken let attacker mint/redirect locked tokens to a Pancake pair and dump them for ~$31K profit via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: ShibaToken
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/ShibaToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231117-shibatoken
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token contract (batchTransferLockToken) + PancakeSwap pair
**Root cause:** batchTransferLockToken failed to validate that the recipient/amount were legitimately locked, allowing an attacker to direct a large token amount to a Pancake pair and swap it out.
**Steps:**
1. Flash loan 20 BNB from DPPOracle `flashLoan(20e18,0,this,"0x00")`
2. Withdraw WBNB to BNB, approve USDT to ICO contract
3. Call `ICO.buyByBnb{value:20e18}(address(0))` to acquire SHIBA tokens
4. Build Airdrop array with pair `0xa19D...` and amount `507677278570125202361500000`
5. Call `x13b1.batchTransferLockToken(airdrops)` to push tokens to the pair
6. Call `pair.swap(0, 30948073916467640719090, attacker, "")` to extract USDT
7. Approve and swap USDT->BNB via Pancake router `swapExactTokensForETHSupportingFeeOnTransferTokens`
8. Repay 20 BNB flash loan, keep ~101.7 BNB profit
**Exploitation:** Attacker flash-borrowed 20 BNB, used it to buy SHIBA via the ICO, then abused batchTransferLockToken to move a huge SHIBA amount into a Pancake pair and swapped it out for USDT, converting to BNB and repaying the loan while pocketing ~101.7 BNB (~$31K).
**Insight:** Audit token 'lock/batch transfer' helper functions for missing checks that the destination is a legitimate lock address; if any address is accepted, an attacker can route locked tokens straight into a DEX pair and dump them.