# BigBangSwap: precision loss in sellRewardToken drains BUSD

Precision loss in BigBangSwap's sellRewardToken let attacker flash-loan BUSD, buy BGG, and repeatedly sell for profit, draining ~$5K BUSD.

- Payout: Real-world hack
- Severity: medium
- Program: BigBangSwap
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/BigBangSwap_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240410-bigbangswap
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium vuln:business-logic vuln:precision-loss

**Target:** BSC smart contract (TransparentUpgradeableProxy) sellRewardToken function
**Root cause:** sellRewardToken likely calculates reward with precision loss, allowing attacker to profit by buying BGG and selling it back repeatedly.
**Steps:**
1. Flash loan 50 BUSD from DODO.
2. Loop 70 times: deploy AttackContract, transfer 15 BUSD to it.
3. In AttackContract, swap BUSD to BGG via PancakeRouter.
4. Call sellRewardToken on vulnerable proxy with BGG balance.
5. Transfer BUSD profit back to main contract.
6. Repay flash loan.
**Exploitation:** Attacker used DODO flash loan of 50 BUSD, then for each of 70 iterations deployed a contract that swapped 15 BUSD for BGG and called sellRewardToken, exploiting precision loss to receive more BUSD than spent, accumulating profit.
**Insight:** Look for reward-selling functions where token-to-reward conversion uses division before multiplication or low-precision math, enabling arbitrage via repeated small trades.