# SSS token: balance doubles on self-transfer drains pool

SSS token doubles balance on self-transfer, allowing attacker to inflate holdings and drain $4.8M from liquidity pool.

- Payout: Real-world hack
- Severity: critical
- Program: SSS
- Analysis by: DeFiHackLabs
- Disclosed: 2024-03-21
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-03/SSS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240321-sss
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical vuln:accounting-error vuln:business-logic

**Target:** ERC20 token contract and Uniswap V2 pool
**Root cause:** The token's transfer logic incorrectly doubles the sender's balance when transferring to self, instead of leaving it unchanged.
**Steps:**
1. Flash loan 1 ETH and wrap to WETH.
2. Swap 1 ETH for SSS tokens via Uniswap V2 router.
3. Repeatedly call `SSS.transfer(address(this), SSS.balanceOf(address(this)))` to double balance until reaching target amount.
4. Burn excess SSS above target to avoid overflow on pair swap.
5. Transfer SSS to the pool in chunks respecting `maxAmountPerTx`.
6. Call `sssPool.swap()` to extract WETH.
7. Repay flash loan and keep profit.
**Exploitation:** Attacker flash-loaned 1 ETH, bought SSS tokens, then exploited the self-transfer bug to exponentially inflate SSS balance. They burned excess, transferred tokens to the pool in chunks, and swapped to drain WETH, netting ~1393 ETH (~$4.8M).
**Insight:** Check token transfer functions for self-transfer edge cases that may incorrectly update balances; such bugs can be amplified with flash loans to drain pools.