# YYStoken: business logic flaw in sell allows flash loan drain

YYStoken sell function had a business logic flaw allowing repeated sells to drain funds via flash loan price manipulation.

- Payout: Real-world hack
- Severity: high
- Program: YYStoken
- Credited: DeFiHackLabs
- Disclosed: 2024-06-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/YYS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240608-yys
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan

**Target:** YYStoken sell contract
**Root cause:** The sell function likely allowed selling tokens without properly updating state or checking balances, enabling repeated sells to extract value.
**Steps:**
1. Flash loan 4,750,000 BUSDT from PancakeSwap V3 pair.
2. Swap 4,749,900 BUSDT for YYStoken via PancakeRouter, manipulating price.
3. Approve YYStoken sell contract and repeatedly call `sell()` with decreasing amounts while balance > 5000 ether.
4. Repay flash loan and keep profit.
**Exploitation:** Attacker used flash loan to buy YYStoken, then repeatedly sold tokens via vulnerable sell function, draining BUSDT from the contract.
**Insight:** Business logic flaws in token sell mechanisms can be exploited via flash loans to manipulate price and drain funds; check for missing state updates or reentrancy-like repeated sells.