# Vista flashLoan burns tokens without freeze check

Vista flashLoan burns tokens but fails to check if they are frozen, allowing attacker to sell burned tokens for profit.

- Payout: Real-world hack
- Severity: high
- Program: Vista
- Analysis by: DeFiHackLabs
- Disclosed: 2024-10-22
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-10/VISTA_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241022-vista
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:business-logic vuln:flash-loan

**Target:** Vista token contract and presale/sale contracts on BSC
**Root cause:** The flashLoan function burns the borrowed tokens but does not verify whether the tokens are frozen, allowing the borrower to still use them.
**Steps:**
1. Flash loan 1500 USDT from PancakeSwap V3 pool.
2. Swap USDT to BUSD and stake BUSD in presale contract to receive VISTA tokens.
3. Call VISTA.flashLoan with the VISTA token amount, triggering onFlashLoan callback.
4. In callback, query getFreeBalance to get free balance, approve sale contract, and call sale.sell with amount based on freeBalance.
5. Repay flash loan and keep profit.
**How found:** Likely identified that flashLoan burns tokens without checking freeze status, enabling double-spend of burned tokens.
**Exploitation:** Attacker flash loans USDT, stakes for VISTA, then uses VISTA flashLoan which burns the tokens but does not freeze them, allowing the attacker to sell the burned tokens via the sale contract for USDT, netting ~$28k profit.
**Insight:** When a token has a flashLoan function that burns tokens, check if the burn also freezes the tokens or updates balances correctly; otherwise burned tokens may still be usable.