# DCFToken: transfer-to-pair burn inflates price, drained via flash loan

DCFToken's transfer to a PancakeSwap pair burns half the tokens, inflating price; attacker flash-loaned BUSD, manipulated pair, sold for ~442k profit.

- Payout: Real-world hack
- Severity: high
- Program: DCFToken
- Credited: DeFiHackLabs
- Disclosed: 2025-03-18
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-03/DCFToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250318-dcftoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP20 token DCF and PancakeSwap V2 pair BUSD-DCF
**Root cause:** DCF token's transfer function burns ~half of the transferred amount when the recipient is a PancakeSwap pair, artificially inflating the token price in that pair.
**Steps:**
1. Flash loan large BUSD from multiple PancakeSwap V3 pools via `flash()`.
2. Recursively swap BUSD for more BUSD across PancakeSwap V2 pairs using `swap()` callbacks.
3. Transfer 83,741 DCF from attacker to attack contract.
4. Swap 80,435 BUSD for 4,039 DCF via PancakeSwap Router.
5. Swap 29,919 BUSD for 1,062,693 DCT via PancakeSwap Router.
6. Transfer 82,756 DCF to PancakeSwap V2 pair BUSD-DCF (`0x8487...`), triggering burn of ~half the amount and inflating DCF price.
7. Sell acquired DCF and DCT for BUSD, repay flash loans, profit ~442k BUSD.
**How found:** Likely identified the token's transfer burn logic when sending to a liquidity pair, enabling price manipulation via direct pair transfers.
**Exploitation:** Attacker flash-loaned BUSD, used recursive swaps to accumulate BUSD, then bought DCF and DCT. By transferring DCF directly to the BUSD-DCF PancakeSwap pair, the token's burn mechanism destroyed half the transferred DCF from the pair, drastically increasing DCF price. Attacker then sold DCF and DCT for a profit of ~442k BUSD.
**Insight:** Tokens with transfer-to-pair burn or fee mechanisms can be exploited by directly sending tokens to a pair to manipulate reserves and price; check for such logic in token contracts.