# P719Token: transfer-to-self sell logic inflates price

P719 token's transfer() treats transfers to itself as sells, burning tokens and inflating price, exploited via flash loan for 547 BNB profit.

- Payout: Real-world hack
- Severity: high
- Program: P719Token
- Analysis by: DeFiHackLabs
- Disclosed: 2024-10-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-10/P719Token_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241011-p719token
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP20 token contract on BSC
**Root cause:** The transfer() function processes any transfer to the P719 contract as a sell, using a Uniswap-like swap to calculate BNB output, then burns most of the sold tokens and transfers fee tokens from itself, artificially inflating the token price.
**Steps:**
1. Attacker deploys a malicious token `MyToken` and creates a PancakeSwap pair with WBNB, adding minimal liquidity.
2. Attacker deploys helper contracts `AttackerC2` that can buy P719 by sending BNB and sell by transferring P719 back to the P719 contract.
3. Attacker flash-loans 4000 WBNB from PancakeV3Pool.
4. Attacker uses 14 helper contracts to buy P719 with 10 BNB each, then 33 helper contracts to buy with 100 BNB each, accumulating P719 tokens.
5. Attacker consolidates P719 tokens into one contract and distributes to 100 helper contracts, each selling by transferring P719 to the P719 contract, triggering the sell logic that burns tokens and inflates price.
6. Attacker swaps remaining WBNB for the malicious token via PancakeRouter, then removes liquidity to extract profit.
7. Attacker repays flash loan and keeps remaining WBNB as profit.
**How found:** Researcher analyzed the unverified P719 contract code and noticed that transfer() to the contract itself is treated as a sell, with token burning and fee transfers that could inflate price.
**Exploitation:** Attacker flash-loans 4000 WBNB, uses it to buy large amounts of P719 tokens across many contracts, then triggers the vulnerable sell logic by transferring tokens back to the P719 contract. This burns tokens and inflates the price. The attacker then sells the inflated P719 tokens into their own malicious token pair, draining WBNB, and removes liquidity to realize profit.
**Escalation:** Used multiple helper contracts to scale the buy/sell operations and amplify the price manipulation.
**Insight:** Look for token contracts where transfers to the contract address trigger special logic (e.g., sell, burn, fee) that can be abused to manipulate price or drain funds, especially when combined with flash loans.