# FIL314: insufficient validation in hourBurn enables price manipulation

FIL314 token's hourBurn() lacked validation, letting attacker repeatedly burn to deflate supply and manipulate getAmountOut price for profit.

- Payout: Real-world hack
- Severity: high
- Program: FIL314
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-12
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/FIL314_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240412-fil314
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** BSC smart contract (FIL314 token)
**Root cause:** hourBurn() could be called repeatedly without validation, allowing arbitrary deflation of token supply; getAmountOut price calculation was manipulable via balance changes.
**Steps:**
1. Attacker calls FIL314 contract with 0.05 BNB to buy tokens.
2. Loop 6000 times calling `FIL314.hourBurn()` to burn tokens and deflate supply.
3. Loop 10 times: compute `amount = FIL314.getAmountOut(address(FIL314).balance, true)` and call `FIL314.transfer(address(FIL314), amount)` to sell tokens at manipulated price.
4. Attacker drains BNB profit (~14 BNB).
**Exploitation:** Attacker bought a small amount of FIL314, then repeatedly called hourBurn() to drastically reduce token supply, inflating the price per token. Then sold tokens back to the contract via transfer, receiving BNB at the inflated rate.
**Insight:** Look for burn or supply-adjusting functions lacking rate limits or access control; repeated calls can manipulate AMM price curves even without flash loans.