# Bob: price manipulation via PancakeSwap LP skim/swap loop

Bob token on BSC was price-manipulated via a flash loan and repeated PancakeSwap LP mint/skim/swap cycles, netting ~3 BNB.

- Payout: Real-world hack
- Severity: high
- Program: Bob
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/Bob_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231217-bob
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC token pair / PancakeSwap router and LP
**Root cause:** The Bob token's price on PancakeSwap could be manipulated by minting LP, then repeatedly skimming and swapping to distort reserves, allowing profitable arbitrage against the router.
**Steps:**
1. Flash loan 100 WBNB from DODO.
2. Swap WBNB for Bob via PancakeSwap router.
3. Add liquidity to Bob/WBNB LP (cakeLP) using WBNB and Bob.
4. Loop 9 times: swap all WBNB to Bob; transfer Bob to LP; call `cakeLP.skim(cakeLP)`; compute amountOut from 96% of LP's Bob balance; call `cakeLP.swap(0, amountOut, attacker, ...)`; swap Bob to WBNB via router; remove liquidity; swap remaining Bob to WBNB.
5. Repay 100 WBNB flash loan to DODO; keep profit (~3 BNB).
**Exploitation:** Attacker used a DODO flash loan to obtain 100 WBNB, then manipulated the Bob/WBNB PancakeSwap pair by minting LP and repeatedly skimming and swapping to extract value, ultimately repaying the loan and keeping ~3 BNB profit.
**Insight:** When a token's LP can be skimmed and swapped in a loop, repeated small manipulations can drain value even without a single large mispricing; watch for tokens with fee-on-transfer or rebasing mechanics that interact with LP reserves.