# Pump: missing slippage protection in buyToken drains funds

Pump token contracts on BSC lacked slippage protection in buyToken, allowing an attacker to manipulate reserves and drain ~$6.4K via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: Pump
- Credited: DeFiHackLabs
- Disclosed: 2025-03-04
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-03/Pump_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250304-pump
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Token contract buyToken function on BSC
**Root cause:** The buyToken function in multiple token contracts did not enforce slippage protection, allowing attackers to manipulate the token price via large purchases and then sell at an inflated price.
**Steps:**
1. Flash loan 100 BNB from PancakeV3Pool BUSD/WBNB.
2. For each vulnerable token (TAGAIFUN, GROK, PEPE, TEST):
3.   - Call `buyToken{value: 0.001 ether}(0, address(0), 0, pair)` to create/initialize pair.
4.   - Deposit 1 WBNB and transfer to pair, then call `pair.mint(address(this))` to add liquidity.
5.   - Call `buyToken{value: 20 ether}(0, address(0), 0, address(this))` to buy tokens with no slippage limit.
6.   - Approve router and swap all tokens to WBNB via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
7. Repay flash loan and transfer profit to attacker.
**Exploitation:** Attacker flash-loaned 100 BNB, then for each vulnerable token, added liquidity to the token/WBNB pair, used buyToken with large BNB to pump the token price, and sold the acquired tokens back to the pair for profit, repaying the flash loan and keeping ~11.29 BNB.
**Insight:** Tokens with buy/sell functions that lack slippage parameters can be manipulated by adding liquidity and then buying large amounts to skew the price before selling; check for missing slippage checks in token contracts.