# MFT: burn-on-transfer logic drains PancakeSwap liquidity pool

MFT token's transfer logic burns tokens from the PancakeSwap pair when selling, allowing an attacker to drain the pool via flash loans and repeated transfers.

- Payout: Real-world hack
- Severity: high
- Program: MFT
- Credited: DeFiHackLabs
- Disclosed: 2024-11-17
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-11/MFT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241117-mft
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan

**Target:** MFT token contract and PancakeSwap LP
**Root cause:** MFT.transfer() burns tokens from the liquidity pool when a user sells, manipulating the pool's reserves.
**Steps:**
1. Flash loan BSC-USD from three PancakeSwap V3 pools.
2. Repeatedly transfer MFT from exploiter to CAKE_LP to trigger burn mechanism.
3. Call skim on CAKE_LP to send excess tokens to pledge address.
4. Swap BSC-USD for MFT via PancakeRouter to lower MFT balance in pair.
5. Transfer MFT to CAKE_LP to manipulate reserves.
6. Sell MFT via pair.swap to drain BSC-USD.
7. Repay flash loans and keep profit.
**Exploitation:** Attacker used flash loans to obtain BSC-USD, then manipulated the MFT/CAKE_LP pair by exploiting the burn-on-transfer logic: transferring MFT to the pair caused tokens to be burned, altering reserves. By buying MFT and then selling, the attacker drained BSC-USD from the pool, repaid flash loans, and profited ~33.7k USD.
**Insight:** Look for tokens with burn-on-transfer or fee-on-transfer mechanics that interact with AMM reserves; such logic can be exploited to manipulate pool balances and drain funds.