# MARS: reflection-tax swap loop drains pair via flash loan

MARS token reflection/tax mechanics let attacker flash-loan WBNB, repeatedly swap and sync the pair to inflate MARS pricing, draining >$100K.

- Payout: Real-world hack
- Severity: high
- Program: MARS
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-16
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/MARS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240416-mars
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token / PancakeSwap V3 pair on BSC
**Root cause:** MARS token applies reflection/tax mechanics that credit the pair contract with reflections on each transfer, so repeated swaps and syncs shift the pair's reserves and pricing in the attacker's favor.
**Steps:**
1. Flash-loan 350 WBNB from PancakeV3 pool `0x3669...2050`
2. Approve router and MARS; loop `swapExactTokensForTokensSupportingFeeOnTransferTokens` WBNB->MARS via fresh `TokenReceiver` contracts, pulling MARS back each iteration
3. Loop MARS->WBNB swaps in 1000-ether chunks to realize inflated value
4. Repay flash loan plus fee; keep profit
**How found:** Analyst (Phalcon) observed the pair contract receiving reflections from token taxes, hypothesizing that repeated swap+sync cycles would let an attacker improve pricing against the pool.
**Exploitation:** Attacker flash-borrows 350 WBNB, uses fee-on-transfer swaps through disposable receiver contracts to accumulate MARS while reflections accrue to the pair, then swaps MARS back to WBNB at the manipulated price, repays the loan and pockets >$100K.
**Insight:** For reflection/fee-on-transfer tokens, check whether the LP pair itself accrues reflections on every swap — a disposable-receiver swap loop can then ratchet reserves in the attacker's favor without needing a single large trade.