# Hackathon token: double-credit skim drains BSC pair

Hackathon token's skim credited the pair's balance twice when sender==recipient==pair, letting an attacker loop skims to drain ~$20K from the BSC pair.

- Payout: Real-world hack
- Severity: high
- Program: Hackathon
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-14
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/Hackathon_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240414-hackathon
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:accounting-error vuln:business-logic

**Target:** BEP-20 token / PancakeSwap pair on BSC
**Root cause:** In the token's transfer/skim logic, when sender == recipient == pair, the recipient balance is credited twice, once in each branch, inflating the pair's token balance without real inflow.
**Steps:**
1. Flash loan 200,000 BUSD from DPP oracle `0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476`.
2. Swap BUSD -> Hackathon via PancakeSwap router `0x10ED43C718714eb63d5aA57B78B54704E256024E`.
3. Transfer all Hackathon tokens to pair `0xd46f4a4B57D8EC355fe83F9AE75d4cC04DE371ED`.
4. Call `Pair.skim(address(Pair))` then `Pair.skim(address(this))` repeatedly (10x inner loop) to exploit the double-credit.
5. Swap Hackathon back to BUSD; repeat outer loop 10x.
6. Repay flash loan and keep ~20K USD profit.
**How found:** Researcher (EXVULSEC) identified the branch where sender==recipient==pair causes a double balance credit, then built a Foundry PoC replaying the on-chain tx.
**Exploitation:** Attacker flash-borrowed 200K BUSD, bought Hackathon tokens, seeded the pair, then abused `skim` with recipient==pair to double-credit balances, looping swaps and skims to extract value, repaying the loan from proceeds.
**Escalation:** Nested loops (10x10) of swap+skim amplified the double-credit into ~20K USD profit.
**Insight:** When auditing token transfer hooks, check skim/sync paths for aliasing where sender==recipient==pair; a single branch crediting both sides lets repeated skim calls inflate pair reserves for free.