# DeezNutz 404: self-transfer inflates balance, drains pair

DeezNutz 404 token lacked transfer validation, allowing self-transfers to inflate balance and drain ~$170k from a Uniswap V2 pair via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: DeezNutz 404
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-21
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/DeezNutz404_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240221-deeznutz404
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** ERC20 token contract and Uniswap V2 pair
**Root cause:** The token contract failed to validate transfers, specifically allowing self-transfers to increase the sender's balance without corresponding deduction.
**Steps:**
1. Flash loan 2000 WETH from Balancer.
2. Swap WETH for DeezNutz tokens on Uniswap V2.
3. Call `DeezNutz.transfer(address(this), DeezNutz.balanceOf(address(this)))` five times to inflate balance.
4. Transfer 1/20 of inflated DeezNutz to the pair to satisfy k value.
5. Swap inflated DeezNutz back to WETH, draining the pair.
6. Repay flash loan and keep profit.
**Exploitation:** Attacker used a Balancer flash loan to acquire WETH, swapped for DeezNutz, exploited the self-transfer bug to multiply token balance, then dumped inflated tokens into the Uniswap pair for WETH, netting ~$170k.
**Insight:** Check token contracts for missing balance update logic on self-transfers; such bugs can be exploited with flash loans to drain liquidity pools.