# MTToken: fee overcharge enables AMM pair drain

MT token's fee logic overcharges transfers to AMM pairs, letting attacker manipulate reserves and drain ~37K USDT via sync and swap.

- Payout: Real-world hack
- Severity: high
- Program: MTToken
- Credited: DeFiHackLabs
- Disclosed: 2026-01-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-01/MTToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260112-mttoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:flash-loan

**Target:** MT token contract and PancakeV2 MT/USDT pair
**Root cause:** MT token's transactionFee() splits transactFeeValue by an unbounded list of percentages without enforcing sum(shares) <= 100, allowing a transfer to debit the sender for far more than amount.
**Steps:**
1. Flash loan max USDT from Moolah flashloan provider.
2. Buy MT via direct pair swap: transfer `189_727e18` USDT to pair, call `PAIR.swap(6_881_053_957_270_342_278_899, 0, attacker, '')`.
3. Seed MT to pair: `MT.transfer(pair, 2_075_238_495_049_785_766_652)` creating skim-able excess.
4. Call `PAIR.skim(attacker)` to drain MT; transfer triggers buggy fee logic again.
5. Call `PAIR.sync()` to lock manipulated reserves.
6. Sell MT for USDT via router: `swapExactTokensForTokensSupportingFeeOnTransferTokens(594_572_298_978_549_731_565, 0, [MT,USDT], attacker, block.timestamp)`.
7. Repay flash loan; profit ~36,995 USDT.
**Exploitation:** Attacker flash-loans USDT, buys MT from the pair, seeds extra MT to the pair, calls skim to drain MT (triggering fee overcharge), syncs reserves, then sells MT for USDT at manipulated rate, draining ~37K USDT from the pool.
**Insight:** Fee-on-transfer tokens with configurable fee shares can overcharge when sending to contracts like AMM pairs; check if sum of fee percentages can exceed 100% and whether pair.skim/sync can be abused to manipulate reserves.