# RPP token logic flaw drained via PancakeSwap swaps

RPP token on BSC had a logic flaw allowing repeated swaps to drain ~$14.1K via flash loan and PancakeSwap.

- Payout: Real-world hack
- Severity: high
- Program: RPP
- Analysis by: DeFiHackLabs
- Disclosed: 2024-11-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-11/RPP_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241105-rpp
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan

**Target:** RPP token contract on BSC
**Root cause:** Logic flaw in RPP token contract likely related to fee-on-transfer or swap mechanics enabling repeated arbitrage.
**Steps:**
1. Flash loan 1,200,000 BUSD from PancakeV3Pool.
2. Approve BUSD and RPP to PancakeV2Router.
3. Loop 1450 times: swap BUSD for exactly 99,999,999,999,999,999,999,999 RPP.
4. Loop: swap RPP for BUSD using swapExactTokensForTokensSupportingFeeOnTransferTokens until RPP balance <= 134,160,000,000,000,000,000,000,214.
5. Repay flash loan plus fee.
6. Transfer remaining BUSD to attacker.
**Exploitation:** Attacker flash-loaned 1.2M BUSD, repeatedly swapped BUSD for RPP and back, exploiting a logic flaw in RPP token to extract ~$14.1K profit.
**Insight:** Look for tokens with flawed swap or fee logic that allow repeated arbitrage when combined with flash loans and DEX routers.