# DOGGO token logic flaw drained via Uniswap flash loan

DOGGO token logic flaw let attacker flash-loan from Uniswap V3 pool, manipulate token balance via router swaps, and drain ~7K USD.

- Payout: Real-world hack
- Severity: high
- Program: DOGGO
- Credited: DeFiHackLabs
- Disclosed: 2024-09-20
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-09/DOGGO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240920-doggo
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** ERC-20 token / Uniswap V3 pool
**Root cause:** Token balance/logic handling in DOGGO allowed an attacker to manipulate the contract's own token balance and swap through Uniswap V2 router to extract WETH.
**Steps:**
1. Flash-borrow 7.54e18 DOGGO from Uniswap V3 pool `0xeA5A...7d0B` via `flash()`
2. In callback, check DOGGO self-balance; approve router and `swapExactTokensForTokensSupportingFeeOnTransferTokens` DOGGO->WETH
3. If DOGGO self-balance still below 4206900000000000001, transfer DOGGO to the DOGGO contract to top it up
4. Swap remaining DOGGO->WETH, then `swapTokensForExactTokens` WETH->DOGGO for 7618671525979720501
5. Repay flash loan with 7618671525979720501 DOGGO to the V3 pool
6. Withdraw WETH to ETH and transfer to attacker EOA
**Exploitation:** Attacker flash-borrowed DOGGO from a Uniswap V3 pool, used router swaps and direct transfers to the DOGGO contract to manipulate its internal balance, then repaid the flash loan and cashed out WETH (~7K USD) to the attacker address.
**Insight:** Fee-on-transfer / self-balance-dependent token logic can be gamed by flash-borrowing the token and forcing transfers to the token contract itself to satisfy internal balance checks before repaying the loan.