# YVToken: missing slippage protection enables reserve manipulation drain

YVToken's swap logic lacked slippage protection, allowing an attacker to manipulate reserves and drain 15,261 BUSD via repeated swaps.

- Payout: Real-world hack
- Severity: high
- Program: YVToken
- Credited: DeFiHackLabs
- Disclosed: 2025-04-16
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-04/YBToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250416-ybtoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:business-logic vuln:oracle-manipulation

**Target:** YVToken contract and its PancakeSwap LP pair
**Root cause:** The YVToken contract's swap function did not enforce slippage protection, allowing an attacker to manipulate the LP pair's reserves and extract value through repeated swaps.
**Steps:**
1. Flash loan 19,200 BUSD from PancakeV3 pool `0x36696169C63e42cd08ce11f5deeBbCeBae652050`.
2. For 66 iterations: transfer `loanAmount/66` BUSD to YB_BUSD_LP pair `0x38231F8Eb79208192054BE60Cb5965e34668350A`, then call `swap` with computed `amount0Out` to reach a target K, sending YB tokens to a child contract.
3. Child contract approves and transfers YB tokens back to attacker.
4. For 66 iterations: transfer `balYB/66` YB tokens to the pair, then call `swap` with computed `amount1Out` to extract BUSD.
5. Repay flash loan and keep profit of 15,261 BUSD.
**How found:** Likely identified through analysis of the YVToken contract's swap function lacking slippage checks, enabling reserve manipulation.
**Exploitation:** Attacker used a flash loan to repeatedly swap between BUSD and YB tokens, manipulating the LP pair's reserves to extract more BUSD than initially deposited, draining funds from the pair.
**Insight:** When a token contract interacts with an AMM pool without slippage protection, an attacker can use repeated swaps to manipulate reserves and extract value; look for swap functions that don't enforce minimum output amounts.