# BscInitcodeToken: arbitrary token path drains WBNB via malicious pool

BscInitcodeToken's public function swapped its own WBNB through attacker-controlled tokens, letting a fee-on-transfer token skew the pool and drain 700 USD.

- Payout: Real-world hack
- Severity: high
- Program: BscInitcodeToken
- Credited: DeFiHackLabs
- Disclosed: 2025-08-04
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/BscInitcodeToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic

**Target:** BSC smart contract with public swap function
**Root cause:** Victim contract exposed a public function accepting arbitrary token path parameters and used its own WBNB balance in PancakeSwap swaps, allowing attacker-controlled fee-on-transfer tokens to manipulate pool reserves.
**Steps:**
1. Deploy two malicious ERC20 tokens (DD, T57) with a transferFrom hook that returns 1 wei when from=victim and to=attacker pair.
2. Seed PancakeSwap pools: addLiquidityETH for DD/WBNB with 0.00001 BNB, and addLiquidity for DD/T57 with 0.1 ether each.
3. Set the malicious token's victim transfer rule to the victim address and the DD/T57 pair.
4. Call victim function `0xdc0b3665` with path [T57, DD] and amountIn = victim's full WBNB balance.
5. Victim swaps WBNB for T57 then T57 for DD; during reverse swap, malicious token transfers only 1 wei from victim, leaving DD/WBNB pair reserve-skewed.
6. Attacker sells pre-minted DD tokens for the victim-funded WBNB via swapExactTokensForETHSupportingFeeOnTransferTokens, profiting ~0.9 BNB.
**How found:** Likely identified the victim's public function accepting arbitrary token addresses and using its own WBNB balance, then crafted fee-on-transfer tokens to manipulate pool reserves during the swap.
**Exploitation:** Attacker deployed two tokens, created tiny PancakeSwap pools, and called the victim's public swap function with those tokens. The victim spent its WBNB buying T57, then sold T57 for DD; the malicious T57 token only transferred 1 wei from the victim during the reverse swap, leaving the DD/WBNB pool with excess WBNB. Attacker then sold pre-minted DD for the victim's WBNB.
**Insight:** Look for public swap functions that accept arbitrary token paths and use the contract's own balance; attacker-controlled tokens with transfer hooks can skew pool reserves to extract value.