# TGBS: burn-block logic flaw enables price manipulation drain

TGBS token's _burnBlock logic let attacker repeatedly self-transfer 1 token to trigger burns in the swap pair, inflating TGBS price before dumping for ~$150K.

- Payout: Real-world hack
- Severity: high
- Program: TGBS
- Analysis by: DeFiHackLabs
- Disclosed: 2024-03-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-03/TGBS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240306-tgbs
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token contract and PancakeSwap pair on BSC
**Root cause:** Token's transfer logic burns tokens in the swap pair when _burnBlock != block.number, but a self-transfer of 1 token can repeatedly trigger the burn condition, deflating pair reserves and inflating price.
**Steps:**
1. Flash loan WBNB from DPPOracle (0x05d9...1eB5).
2. Swap WBNB to TGBS via PancakeSwap Router.
3. Loop up to 1600 times: `TGBS.transfer(address(this), 1)` then read `TGBS._burnBlock()`; each iteration where burnBlock != block.number causes TGBS to be burned in the swap pair.
4. Approve and swap all TGBS back to WBNB at the inflated price.
5. Repay flash loan, keep profit.
**Exploitation:** Attacker flash-borrowed WBNB, bought TGBS, then spammed 1-token self-transfers to trigger the burn-in-pair logic ~1600 times, shrinking pair TGBS reserves and pumping price, then sold TGBS back for WBNB and repaid the loan.
**Insight:** When a token's transfer hook burns from the AMM pair based on a mutable state variable (_burnBlock), a 1-wei self-transfer can be looped to repeatedly drain pair reserves; check token transfer hooks for state-dependent burns that an attacker can trigger cheaply.