# ATM: business logic flaw enables sandwich drain of WBNB pair

ATM token's swap-and-liquify logic on BSC was sandwich-attacked via repeated transfer+skim to drain ~$182K from the ATM/WBNB pair.

- Payout: Real-world hack
- Severity: high
- Program: ATM
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-01
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/ATM_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240401-atm
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan

**Target:** ATM/WBNB PancakeSwap V2 pair on BSC
**Root cause:** The ATM token contract performs token->WBNB and WBNB->USDT swaps on transfers, and its liquidity/skim interaction lets an attacker repeatedly transfer ATM and call skim to extract WBNB from the pair at the contract's expense.
**Steps:**
1. Flash-borrow ~all WBNB from PancakeSwap V3 pool `0x3669...2050` via `pool.flash`.
2. Swap most WBNB to USDT on PancakeSwap V2 router, keeping ~170 WBNB.
3. Loop: swap 70 WBNB to ATM, then repeatedly `ATM.transfer(wbnb_atm, balance)` and `wbnb_atm.skim(address(this))` until pair loses ~7 WBNB per iteration.
4. Repeat transfer+skim up to 15 times until pair_lost == 0 to maximize WBNB extraction.
5. Swap remaining ATM back to WBNB, swap USDT back to WBNB.
6. Repay flash loan `borrow_amount * 10000/9975 + 1000`; keep ~$182K profit.
**How found:** PoC notes a sandwich attack: the contract exchanges token->WBNB and WBNB->USDT on transfer, so transfer/skim can be used to extract value from the pair.
**Exploitation:** Attacker flash-borrowed WBNB, converted part to USDT, then used the ATM token's transfer-triggered swap behavior combined with `skim` on the ATM/WBNB pair to repeatedly remove WBNB from the pair, then swapped profits back and repaid the flash loan.
**Insight:** When a token's transfer hook performs swaps, check whether repeated transfer+skim against its liquidity pair can be used to arbitrage the pair's reserves at the token contract's expense.