# VDS: burn-to-contract returns AVD 1:1 enabling flash-loan drain

VDS token's deposit/burn logic let an attacker flash-loan BSC_USD, swap to AVD, deposit for VDS, then burn VDS to recover AVD 1:1 and profit.

- Payout: Real-world hack
- Severity: high
- Program: VDS
- Credited: DeFiHackLabs
- Disclosed: 2025-07-16
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/VDS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250716-vds
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token contract on BSC (deposit/burn logic)
**Root cause:** Sending VDS tokens to the VDS contract address triggers a burn that returns AVD at a 1:1 ratio, decoupled from the deposit exchange rate, allowing round-trip arbitrage.
**Steps:**
1. Flash loan 20,000 BSC_USD from Moolah via `flashLoan(BSC_USD, 20000 ether, "")`
2. Approve PancakeSwap router and swap BSC_USD -> AVD via `swapExactTokensForTokensSupportingFeeOnTransferTokens`
3. Approve VDS contract and call `deposit(VDS_TOKEN, avdBalance)` to receive VDS
4. Transfer `168205391822` VDS to the VDS contract address to trigger burn and receive AVD back 1:1
5. Swap recovered AVD -> BSC_USD on PancakeSwap and repay flash loan
**How found:** Not described; PoC reproduced by DeFiHackLabs from on-chain attack tx and SlowMist analysis.
**Exploitation:** Flash loan provides capital; swap into AVD, deposit into VDS, then burn VDS by sending to the contract to reclaim AVD at a favorable 1:1 rate, then swap back to BSC_USD for profit (~13k USD).
**Insight:** When a token's burn/deposit path returns a paired asset at a fixed 1:1 ratio, compare it against the AMM exchange rate for the deposit token—any divergence is a flash-loanable round-trip.