# MAMO: price manipulation via flash loan and BuyToken

MAMO token price manipulated via flash loan and direct BuyToken call, then swapped against PancakePair to drain ~$3.3K in USDT.

- Payout: Real-world hack
- Severity: medium
- Program: MAMO
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/MAMO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231205-mamo
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** MAMO token contract and PancakeSwap pair
**Root cause:** The MAMO token's BuyToken function allowed purchasing tokens at a fixed or manipulable price, and the PancakeSwap pair's reserves could be skewed by large token purchases, enabling arbitrage.
**Steps:**
1. Flash loan 19 BNB from DVM (dodo) via `dvm.flashLoan(0, 19e18, me, "0x21")`.
2. Withdraw WBNB to BNB: `wbnb.withdraw(quoteAmount)`.
3. Call `BuyToken(address pair)` on contract `0xa915...` with 19 BNB to receive 95,000,000 MAMO.
4. Swap 95,000,000 MAMO for USDT via PancakePair `pair.swap(0, amount_out, address(this), "")`.
5. Approve and swap USDT for WBNB via PancakeRouter to repay flash loan.
6. Repay 19 BNB to DVM, keep profit.
**Exploitation:** Attacker used a flash loan to obtain 19 BNB, bought MAMO at a manipulated price via BuyToken, dumped MAMO into the PancakePair for USDT, swapped USDT back to WBNB, repaid loan, and kept ~$3.3K profit.
**Insight:** Look for token contracts with public buy/sell functions that use spot reserves or fixed rates; a large flash-loan-funded purchase can skew the pool and be arbitraged.