# BCT: inviter referral abuse drains PancakeSwap pair

BCT token's inviter referral contract was abused via repeated buy/skim swaps to manipulate the KIMO/WBNB PancakeSwap pair, netting ~10.2 BNB.

- Payout: Real-world hack
- Severity: high
- Program: BCT
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-09
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/BCT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231209-bct
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BCT token inviter contract and PancakeSwap KIMO/WBNB pair
**Root cause:** The inviter contract's buy/f_0xf986351d functions let attacker-controlled Tool contracts transfer BCT and trigger swaps against the PancakeSwap pair without proper accounting, enabling repeated reserve manipulation.
**Steps:**
1. Deploy 5 Tool contracts from attacker EOA; each Tool's constructor stores tx.origin.
2. Swap small WBNB for BCT via router, transfer BCT to Tool[0], call `f_0x4e515153(bct, attacker, 5e14)` to seed inviter links.
3. Loop linking Tool[i] and Tool[i+1] via `f_0x4e515153` to build a 5-deep inviter chain.
4. Call `PancakePair.swap(20e18, 0, attacker, "0x20")` on KIMO/WBNB pair to enter pancakeCall.
5. In pancakeCall, walk `IBCT(bct).inviter(...)` chain to collect 5 inviter addresses.
6. For each inviter, transfer WBNB and call `IInviter(inviter).buy(wbnb, pancakepair, buyAmount)` to swap 60e18 BCT out of the pair.
7. Loop 10x: transfer WBNB to pair, `swap(amount,0,cake_lp,"")`, `cake_lp.skim(attacker)`; drain BCT into cake_lp and skim back.
8. Call `process(30e18, inviters)` to invoke `f_0xf986351d` on each inviter, moving BCT to pair and BUSD through cakeLP, then swap back to WBNB.
9. Repay 20.05e18 WBNB to PancakePair; keep ~10.2 BNB profit.
**Exploitation:** Attacker deployed 5 helper Tool contracts and chained them as inviters of the BCT token. Using a flash-swap from the KIMO/WBNB PancakeSwap pair, they repeatedly invoked the inviter's buy and f_0xf986351d functions to push BCT into the pair and skim LP tokens, then routed BUSD through the cake LP to convert back to WBNB, repaying the flash swap and pocketing ~10.2 BNB.
**Escalation:** Chained 5 inviter contracts and 10 skim/swap iterations to amplify reserve manipulation and extract more value per flash loan.
**Insight:** Referral/inviter contracts that expose buy/transfer primitives callable by arbitrary EOAs are a lever for manipulating the underlying AMM pair — enumerate inviter chains and test whether each level can be driven to swap against the pair.