# INVISTECH: pair-side tax drains pool via price manipulation

INVISTECH token taxes buys by charging the tax from the pair itself, letting an attacker manipulate pool price and profit 5.14 WBNB via flash loan.

- Payout: Real-world hack
- Severity: medium
- Program: INVISTECH
- Credited: DeFiHackLabs
- Disclosed: 2025-02-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/INVISTECH_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250224-invistech
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token / PancakeSwap pair
**Root cause:** The token's transfer tax is charged from the pair's own INVISTECH balance on buys, so each buy removes extra tokens from the pool and skews the price.
**Steps:**
1. Flash borrow 3000 WBNB from Pancake V3 USDT/WBNB pool
2. `swapExactTokensForTokensSupportingFeeOnTransferTokens` WBNB->INVISTECH to trigger pair-side tax and skew price
3. Helper swaps USDT->WBNB, adds liquidity to INVISTECH/WBNB pair, then buys INVISTECH
4. Sell all INVISTECH back to WBNB via fee-on-transfer swap
5. Repay flash loan plus fee; keep >5 WBNB profit
**How found:** Observation that the token taxes transfers when either side is a configured pair, and on buys the tax is deducted from the pair balance rather than the buyer, making pool reserves manipulable.
**Exploitation:** Attacker flash-loaned 3000 WBNB, bought INVISTECH to exploit the pair-side tax that removes extra tokens from the pool, used a helper with pre-positioned USDT to add liquidity and buy more, then sold the accumulated INVISTECH for WBNB and repaid the flash loan, netting 5.14 WBNB.
**Insight:** For fee-on-transfer tokens, check which address actually pays the tax on each swap direction; if the pair pays, reserves shift without the attacker spending, enabling reserve-skew arbitrage.