# AIRWA: unprotected setBurnRate enables LP price manipulation drain

AIRWA token's unprotected setBurnRate let attacker set 98% burn, transfer 0 to LP to inflate price, then dump tokens for ~56.73 BNB profit.

- Payout: Real-world hack
- Severity: high
- Program: AIRWA
- Credited: DeFiHackLabs
- Disclosed: 2025-04-04
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-04/AIRWA_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250404-airwa
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BEP-20 token contract on BSC with PancakeSwap LP
**Root cause:** setBurnRate is callable by anyone, allowing arbitrary burn rate changes that affect transfer amounts and thus LP reserves/pricing.
**Steps:**
1. Attacker contract swaps 0.1 BNB to AIRWA via PancakeRouter path wBNB->BSC_USD->AIRWA.
2. Call `IAIRWA(AIRWA).setBurnRate(980)` to set 98% burn rate.
3. Call `IAIRWA(AIRWA).transfer(CAKE_LP, 0)` to trigger a zero-value transfer to the LP, which with high burn rate manipulates the LP's token balance/price.
4. Call `IAIRWA(AIRWA).setBurnRate(0)` to reset burn rate.
5. Approve PancakeRouter for max AIRWA.
6. Swap all AIRWA back to BNB via path AIRWA->BSC_USD->wBNB using `swapExactTokensForETHSupportingFeeOnTransferTokens`.
7. Receive BNB in fallback and forward to attacker.
**How found:** Likely identified that setBurnRate lacked access control and that a zero-value transfer to the LP combined with a high burn rate could manipulate the LP's token balance and price.
**Exploitation:** Attacker flash-funded 0.1 BNB, bought AIRWA, set burn rate to 980 (98%), executed a zero-amount transfer to the Cake LP to distort its internal accounting/price, reset burn rate, then sold the acquired AIRWA for ~56.73 BNB, draining value from the LP.
**Insight:** Look for unprotected setters of fee/burn/tax parameters in token contracts; even a zero-value transfer to the LP can be used to trigger fee logic and skew reserves when combined with extreme parameter values.