# SlurpyCoin: logic flaw in BuyOrSell enables price manipulation

SlurpyCoin's BuyOrSell logic flaw let an attacker flash-loan 40 WBNB, manipulate token price via repeated transfers, and drain ~3k USD.

- Payout: Real-world hack
- Severity: medium
- Program: SlurpyCoin
- Credited: DeFiHackLabs
- Disclosed: 2024-12-18
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-12/SlurpyCoin_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241218-slurpycoin
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token contract on BSC
**Root cause:** The BuyOrSell() function, triggered on transfers to the token contract, incorrectly updates price or reserves, allowing an attacker to manipulate the token price through repeated transfers.
**Steps:**
1. Flash loan 40 WBNB from DODO.
2. Approve PancakeRouter to spend WBNB.
3. Loop 16 times: swap WBNB for exact amount of SLURPY via PancakeRouter, then loop 15 times: transfer 100,000 SLURPY to the SLURPY contract (triggering BuyOrSell) and transfer 1 wei to self to trigger swapEthForTokens.
4. Deploy 8 helper contracts, each buying 1,300,000 SLURPY via PancakeRouter.
5. Sell all SLURPY (from attacker and helpers) for WBNB at manipulated higher price.
6. Repay 40 WBNB flash loan to DODO.
7. Withdraw WBNB to BNB.
**Exploitation:** Attacker flash-loaned 40 WBNB, used PancakeSwap to buy SLURPY, then repeatedly transferred SLURPY to the token contract to trigger BuyOrSell() and manipulate price. Helper contracts bought more SLURPY, then all tokens were sold for WBNB at inflated price, repaying loan and keeping profit.
**Insight:** Token contracts with transfer-triggered logic (like BuyOrSell) can be vulnerable to price manipulation via repeated transfers; monitor for functions that alter reserves or price on every transfer.