# BBXToken: zero-transfer burn manipulation drains PancakeSwap pool

BBX token's burn-on-transfer logic could be triggered by zero-value transfers, draining BUSD from the PancakeSwap BBX/BUSD pool for 11,902 BUSD profit.

- Payout: Real-world hack
- Severity: high
- Program: BBXToken
- Credited: DeFiHackLabs
- Disclosed: 2025-03-20
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-03/BBXToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250320-bbxtoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** BBX token contract and PancakeSwap V2 BBX/BUSD pair
**Root cause:** The BBX token contract likely burns tokens from the liquidity pool on every transfer (including zero-value transfers), reducing the pool's BBX balance and thus the token price. Repeated zero-value transfers amplify the burn, allowing an attacker to buy BBX cheaply and sell at a manipulated higher price.
**Steps:**
1. Attacker deploys attack contract with 0.05 BNB.
2. Contract swaps BNB to BBX via PancakeSwap Router (path: WBNB->BUSD->BBX).
3. Contract calls `BBX.transfer(address(this), 0)` 500 times, each triggering a burn from the liquidity pool.
4. Contract approves router to spend BBX.
5. Contract swaps all BBX to BUSD via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
6. Attacker receives 11,902 BUSD profit.
**How found:** The attacker likely noticed that the BBX token burns tokens on every transfer, including zero-value transfers, and that the burn is taken from the liquidity pool. By repeatedly calling transfer with zero amount, they could artificially reduce the pool's BBX balance and manipulate the price.
**Exploitation:** The attacker used a flash-loan-free approach: starting with 0.05 BNB, they bought BBX, then executed 500 zero-value transfers to the contract itself. Each transfer triggered the token's burn mechanism, which burned BBX from the liquidity pool, drastically reducing the pool's BBX reserves and thus the BBX price. The attacker then sold their BBX for BUSD at the inflated price, netting 11,902 BUSD.
**Insight:** Check token contracts for burn-on-transfer logic that applies to zero-value transfers and burns from the liquidity pool; such tokens can be manipulated by spamming zero-value transfers to drain the pool.