# DominoTT: precision loss in burn/multicall drains WBNB pair

DominoTT token burn via multicall and forwarder signature replay caused precision loss in pair sync, netting ~5 WBNB via flash loan.

- Payout: Real-world hack
- Severity: medium
- Program: DominoTT
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/DominoTT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231228-dominott
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium technique:chained vuln:flash-loan vuln:precision-loss vuln:signature-replay

**Target:** BSC token contract and PancakeSwap pair
**Root cause:** The burn function called via multicall with a crafted signature (likely replayed) allowed burning a large amount, and subsequent sync caused precision loss in the pair's reserves, enabling profitable arbitrage.
**Steps:**
1. Flash loan 0.5 WBNB from DODO.
2. Swap WBNB to DominoTT via PancakeRouter.
3. Call Forwarder.execute with a pre-signed ForwardRequest (r,s,v) to invoke DominoTT.multicall containing burn(1_970_000e18, Pair).
4. Call Pair.sync() to update reserves after burn.
5. Swap all DominoTT back to WBNB via PancakeRouter.
6. Repay 0.5 WBNB flash loan, keeping profit.
**Exploitation:** Attacker used a flash loan to acquire WBNB, swapped to DominoTT, then used a forwarder signature to execute a multicall that burned a large amount of DominoTT tokens from the pair, followed by sync to manipulate reserves. The precision loss in the pair's accounting allowed swapping back at a favorable rate, extracting ~5 WBNB.
**Insight:** Look for token contracts with burn functions callable via multicall and meta-transactions where signature replay or missing nonce validation can let an attacker burn tokens from a liquidity pair, then sync to exploit rounding errors.