# MINER: flash-loan skim loop drains PancakeSwap pair

MINER token pair on BSC was drained of ~3.5 WBNB via a flash-loan-funded skim loop that manipulated the pair's reserves.

- Payout: Real-world hack
- Severity: medium
- Program: MINER
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/MINER_bsc_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240213-miner-bsc
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** PancakeSwap pair for MINER/WBNB on BSC
**Root cause:** The MINER token's transfer logic or the pair's skim function allowed an attacker to repeatedly transfer tokens to the pair and call skim, manipulating reserves without proper invariant checks.
**Steps:**
1. Flash loan 10 WBNB from DODO via `flashLoan(10e18, 0, address(this), ...)`.
2. Swap WBNB for MINER using `Router.swapTokensForExactTokens(10e12, baseAmount, [WBNB, MINER], ...)`.
3. Loop 50 times: transfer entire MINER balance to the pair, then call `Pair.skim(address(Pair))`.
4. After loop, call `Pair.swap(0, 3_500_751_853_374_879_579, address(this), '')` to extract WBNB.
5. Repay 10 WBNB to DODO; keep remaining ~3.5 WBNB profit.
**Exploitation:** Attacker used a DODO flash loan of 10 WBNB to buy MINER, then repeatedly transferred MINER to the PancakeSwap pair and called skim, which adjusted reserves in a way that allowed a final swap to extract ~3.5 WBNB profit.
**Insight:** When a token pair exposes skim(), check if repeated transfers + skim can desynchronize reserves from the actual token balances, especially if the token has transfer hooks or fee-on-transfer mechanics.