# WETC: incorrect burn logic enables PancakeSwap pool drain

WETC token's incorrect burn logic let an attacker manipulate the BUSD/WETC PancakeSwap pool via skim/sync and drain ~101k USD.

- Payout: Real-world hack
- Severity: high
- Program: WETC
- Credited: DeFiHackLabs
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/WETC_Token_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250717-wetc-token
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token contract and BUSD/WETC PancakeSwap V2 pool on BSC
**Root cause:** Incorrect burn logic in the WETC token contract allowed reserve manipulation of the BUSD/WETC LP pair, letting the attacker distort pool pricing.
**Steps:**
1. Flash loan 1,000,000 BUSD from PancakeSwap V3 pool `0x92b7...3121`.
2. In callback, swap small amount on BUSD/WETC V2 pair `0x8e2c...D0E3` to trigger `pancakeCall`.
3. Transfer large WETC amounts directly to the pair, call `skim` then `sync` to desync and inflate reserves.
4. Repeat transfer/skim/sync with more WETC to further distort price.
5. Transfer small BUSD and more WETC, then `swap(351495403570120114936199, 0, ...)` to extract BUSD.
6. Repay flash loan plus fee; keep remaining BUSD as profit.
**Exploitation:** Attacker flash-loaned 1M BUSD, then repeatedly transferred WETC into the BUSD/WETC LP and called skim/sync to force reserves out of sync with balances, inflating the WETC reserve. With the price distorted, they swapped for ~351k BUSD, repaid the flash loan, and netted ~101k USD profit.
**Insight:** When a token's burn/transfer logic is flawed, direct transfers plus skim/sync on a V2 pair can desync reserves from balances; watch for tokens where burn accounting diverges from actual balances to find manipulable pools.