# LABUBU Token: logic flaw in transfer enables flash loan profit

LABUBU token's transfer logic flaw let attacker flash-loan tokens, inflate balance via repeated self-transfers, then swap for VOVO and BNB, netting 17.4 BNB.

- Payout: Real-world hack
- Severity: high
- Program: LABUBU Token
- Credited: DeFiHackLabs
- Disclosed: 2024-12-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-12/LABUBU_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241210-labubu
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token contract on BSC
**Root cause:** The token's transfer function likely mishandles balance updates when transferring to self or during flash loans, allowing balance inflation without corresponding cost.
**Steps:**
1. Flash loan 415636276381601458 LABUBU from PancakeV3Pool.
2. In callback, loop 30 times: `IERC20(LABUBU).transfer(address(this), amount0)` to inflate balance.
3. Repay flash loan amount + fee.
4. Approve and swap inflated LABUBU for VOVO via PancakeV3Router `exactInputSingle`.
5. Swap VOVO for wBNB via PancakeV2Router `swapExactTokensForETHSupportingFeeOnTransferTokens`.
6. Profit 17.4 BNB (~$12,048).
**Exploitation:** Attacker flash-borrowed LABUBU, repeatedly transferred tokens to self to exploit a logic flaw that increased balance, repaid loan, then swapped inflated tokens for VOVO and BNB, extracting 17.4 BNB.
**Insight:** Check token transfer logic for self-transfer or flash-loan-induced balance inflation; loops of transfers to self can exploit flawed accounting.