# Token8633: flash-loan price manipulation drains PancakeSwap liquidity

Token8633 on BSC was drained of ~$52K via a flash-loan price manipulation exploiting its autoAddLp/autoSwapAndAddToMarketing helper functions.

- Payout: Real-world hack
- Severity: high
- Program: Token8633_9419
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/Token8633_9419_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231117-token8633-9419
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token helper contracts and PancakeSwap V3 pool
**Root cause:** Token helper functions autoAddLp and autoSwapAndAddToMarketing perform swaps/LP additions using manipulable spot pool prices, letting an attacker distort reserves and extract value.
**Steps:**
1. Flash-borrow 1.1e24 USDT from PancakeSwap V3 pool `0x92b7` via `flash()`.
2. In callback, transfer ~12,963 USDT to helper `0x1281` and call `autoAddLp()` 130 times to skew the 8633/USDT pair.
3. Swap USDT into token `0x0cca` via router `0x10ed` using `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
4. Transfer 1e24 USDT to pair `0x5b4d` and call `swap(0, 12.75e30, 0x5a52, '')` to dump 0x0cca into victim `0x5a52`.
5. Call `0x5a52` with selector `0x004b2cc0` to trigger its swap logic, receiving 8633 tokens.
6. Loop `autoSwapAndAddToMarketing()` 900 times on helper `0x11cd` to inflate 8633 balance.
7. Swap 8633 back to USDT via router, repay flash loan 1.1e24, and transfer ~26,362 USDT profit to attacker `0xba0b`.
**Exploitation:** Flash loan from PancakeSwap V3 funds the attack; repeated helper calls manipulate pool reserves, then a crafted swap into victim contract 0x5a52 and mass autoSwapAndAddToMarketing calls inflate the attacker's 8633 holdings, which are swapped back to USDT for profit after repaying the loan.
**Insight:** Token contracts exposing public 'autoAddLp'/'autoSwapAndAddToMarketing' helpers that read spot pool reserves are prime manipulation targets: loop the helper to skew reserves, then dump into a victim contract that trusts those prices.