# WXC: incorrect burn mechanism enables flash-loan pair drain

WXC token's flawed burn mechanism let an attacker flash-loan WBNB, manipulate the WXC/WBNB PancakeSwap pair, and drain 37.5 WBNB.

- Payout: Real-world hack
- Severity: high
- Program: WXC
- Credited: DeFiHackLabs
- Disclosed: 2025-08-11
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/WXC_Token_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250811-wxc-token
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token / PancakeSwap pair
**Root cause:** The WXC token's burn logic is incorrect, allowing an attacker to manipulate the token's balance/price in the PancakeSwap pair via a crafted swap callback payload.
**Steps:**
1. Flash-loan 49.15 WBNB from ERC1967Proxy (0x8F73...) via `flashLoan(WBNB, 49150000000000000000, "0x00")`
2. In `onMoolahFlashLoan`, call `Cake_LP.swap(74963130190599057252979324, 1, attacker, crafted_bytes)` on pair 0xdA5C...
3. Inside `pancakeCall`, transfer 49.15 WBNB back to the pair
4. Approve WXC to PancakeRouter and call `swapExactTokensForTokensSupportingFeeOnTransferTokens(74963130190599057252979324, 0, [WXC,WBNB], attacker, deadline)`
5. Repay flash loan and keep remaining WBNB profit
**Exploitation:** Attacker flash-borrows WBNB, uses a crafted swap callback payload on the WXC/WBNB pair to exploit the token's faulty burn, then swaps the acquired WXC back to WBNB via the router, netting 37.5 WBNB after repaying the flash loan.
**Insight:** When auditing fee-on-transfer or burn-on-transfer tokens, check whether the burn path can be triggered from within a PancakeSwap `pancakeCall` callback with attacker-controlled calldata, letting the pair's reserves be skewed before the router swap.