# AIZPTToken: wrong price calculation exploited via flash loan

AIZPT token on BSC had a flawed price calculation; attacker used a flash loan to manipulate the token's price and drain 34.88 BNB (~$20K).

- Payout: Real-world hack
- Severity: high
- Program: AIZPTToken
- Analysis by: DeFiHackLabs
- Disclosed: 2024-10-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-10/AIZPTToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241005-aizpttoken
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** AIZPT token contract on BSC
**Root cause:** The token contract's price calculation logic was flawed, allowing an attacker to manipulate the token's price by making large transfers to the contract itself.
**Steps:**
1. Flash loan 8000 WETH from PancakeV3Pool.
2. Withdraw WETH to BNB and send 8000 BNB to AIZPT contract via `AIZPT.call{value: 8000 ether}("")`.
3. Loop 199 times: transfer 3,837,275 AIZPT tokens to the AIZPT contract itself.
4. Deposit remaining BNB back to WETH and repay flash loan with fee (8004.1 WETH).
5. Profit remains as WETH in attacker contract.
**How found:** Likely identified through source code review of the AIZPT token contract, noticing that the price calculation did not properly account for transfers to the contract itself, allowing manipulation via self-transfers.
**Exploitation:** Attacker flash-loaned 8000 WETH, converted to BNB, sent to AIZPT contract, then repeatedly transferred AIZPT tokens to the contract itself, exploiting the flawed price calculation to inflate the token's value. After repaying the flash loan, the attacker kept the remaining WETH as profit.
**Insight:** When auditing token contracts, check if price or balance calculations can be manipulated by transferring tokens directly to the contract address, especially if the contract uses its own balance in pricing logic.