# SATURN: sell-limit bypass enables pool price manipulation

SATURN token's per-sell limit let attacker manipulate WBNB/SATURN pool reserves via flash loan, then dump tokens for ~15 BNB profit.

- Payout: Real-world hack
- Severity: high
- Program: SATURN
- Analysis by: DeFiHackLabs
- Disclosed: 2024-05-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-05/SATURN_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240507-saturn
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token and PancakeSwap WBNB/SATURN pair
**Root cause:** SATURN enforces an everyTimeSellLimitAmount on sells, but the limit is computed against pool balance rather than a fair price, so an attacker can top up the pool and swap around the limit to skew reserves.
**Steps:**
1. Flash borrow 3300 WBNB from PancakeV3 pool `0x3669...`
2. Read `everyTimeSellLimitAmount()` and current SATURN balance of pair `0x49BA...`
3. Compute WBNB needed via `router.getAmountsIn(amount - limit, buyPath)` and buy SATURN, sending to creator
4. Roll block +1, transfer `finalSaturnSellAmt` SATURN into the pair to inflate reserves
5. Call `pair_WBNB_SATURN.swap(0, amounts[1], attacker, "")` to extract WBNB
6. Repay flash loan `flashAmt + fee1` to PancakeV3 pool
**How found:** Attacker likely noticed the sell-limit logic keys off pool balance rather than price, allowing reserve skewing within the limit; reproduced by DeFiHackLabs from on-chain tx.
**Exploitation:** Flash loan WBNB, buy SATURN up to just under the sell limit, artificially inject SATURN into the pair to shift reserves, then swap out WBNB at the manipulated rate and repay the flash loan, netting ~15 BNB.
**Insight:** When a token enforces a max-sell-per-tx limit based on pool balance, check whether injecting tokens directly into the pair (bypassing the router) shifts reserves enough to make the capped sell profitable.