# IPC: burn-on-sell pair manipulation drains 590k USDT

IPC token burns pair tokens on every sell, so an attacker flash-loaned USDT and looped buy/sell swaps to drain ~590k USDT from the IPC/USDT PancakeSwap pair.

- Payout: Real-world hack
- Severity: high
- Program: IPC Incorrect burn pairs
- Credited: DeFiHackLabs
- Disclosed: 2025-01-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/IPC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250107-ipc
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** IPC/USDT PancakeSwap V2 pair on BSC
**Root cause:** The IPC token burns pair-held tokens on every sell, so each sell reduces pair reserves and pumps the IPC price; repeated buy/sell cycles extract value from the pair.
**Steps:**
1. Flash-loan 256285582578788161478508 USDT from DVM1 (0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476).
2. Inside callback, flash-loan 77794276765052816860394 USDT from DVM2 (0x0e15e47C3DE9CD92379703cf18251a2D13E155A7).
3. Loop 16 times: call `pair.swap(1, values[1], address(this), abi.encode(usdtAmount))` to buy IPC with nearly all USDT (bypassing time-lock by swapping 1 USDT out).
4. Approve router and sell all IPC back via `swapExactTokensForTokensSupportingFeeOnTransferTokens`, which burns pair tokens and pumps price.
5. Repay DVM2 and DVM1 flash loans; keep remaining USDT (~590k profit).
**How found:** Attacker (or analyst) noticed the IPC token burns pair tokens on every sell, making the pair price manipulable via repeated swaps; front-ran the victim's sell transaction.
**Exploitation:** Attacker flash-loaned USDT from two DODO V2 pools, then repeatedly bought IPC and sold it back through the PancakeSwap pair. Each sell burned pair-held IPC, shrinking reserves and raising price, so the loop extracted USDT from the pair. Loans repaid, ~590k USDT profit.
**Escalation:** Chained two DODO flash loans to scale capital and looped 16 buy/sell cycles to maximize extraction.
**Insight:** When a token burns reserves on transfer/sell, the AMM pair price is not invariant under repeated swaps; check for deflationary/burn-on-sell tokens and simulate buy-sell loops against the pair to see if reserves can be drained.