# AST token: faulty transfer logic enables double skim exploit

AST token's faulty transfer logic double-counted LP tokens during skim, letting an attacker drain ~65K USD via flash loan and price manipulation.

- Payout: Real-world hack
- Severity: high
- Program: Ast
- Credited: DeFiHackLabs
- Disclosed: 2025-01-21
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/Ast_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250121-ast
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:business-logic

**Target:** AST token contract and PancakeSwap BUSD/AST LP pool
**Root cause:** The AST token's transfer logic incorrectly handles LP token transfers during skim, causing the pool to release more tokens than intended.
**Steps:**
1. Flash loan 30M BUSD from PancakeV3Pool.
2. Swap all BUSD for AST via PancakeRouter, sending AST to the ERC1967Proxy.
3. Transfer 1 BUSD and lpAstAmount AST directly to the BUSD/AST LP pool.
4. Call skim on the LP pool to withdraw excess tokens, triggering the faulty transfer logic that double-counts.
5. Swap all AST back to BUSD and repay flash loan.
**Exploitation:** Attacker used a flash loan to manipulate the BUSD/AST pool, then exploited the faulty transfer logic during skim to withdraw extra AST, sold it for BUSD, and repaid the loan, netting ~65K USD.
**Insight:** When a token's transfer logic interacts with LP pool skim/sync, check for double-counting or reentrancy that can inflate balances; direct transfers to the pool followed by skim can bypass normal addLiquidity checks.