# LAXO Token: incorrect burn logic enables ~137K US$ drain

Incorrect burn logic in LAXO token let an attacker flash-loan BUSD, manipulate the LAXO/BUSD pair, and drain ~137K US$ via a swap.

- Payout: Real-world hack
- Severity: high
- Program: LAXO Token
- Credited: DeFiHackLabs
- Disclosed: 2026-02-22
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-02/LAXO_Token_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260222-laxo-token
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token contract and PancakeSwap V2/V3 pairs on BSC
**Root cause:** The token's burn logic is incorrect, allowing an attacker to inflate the LAXO balance held by the BUSD pair and then swap it out for BUSD at a manipulated rate.
**Steps:**
1. Flash-borrow 350,000 BUSD from PancakeSwap V3 pair `0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb` via `pancake.flash(...)`
2. Swap the borrowed BUSD for LAXO through the PancakeSwap router `swapExactTokensForTokensSupportingFeeOnTransferTokens`
3. Add liquidity with LAXO + ETH via `addLiquidityETH`, then `removeLiquidityETHSupportingFeeOnTransferTokens` to trigger the flawed burn logic
4. Confirm LAXO balance of BUSD pair equals `52_057_043_674_336_149_349_295_101`, then transfer that LAXO to the BUSD pair
5. Call `busd_pair.swap(amountOut, 0, ...)` with amountOut `487_495_176_743_718_966_418_330` BUSD
6. Repay the 350,175 BUSD flash loan to the V3 pair; attacker nets `137_320_176_743_718_966_418_330` BUSD
**Exploitation:** Attacker flash-borrows 350K BUSD from a PancakeSwap V3 pair, swaps into LAXO, adds/removes liquidity to trigger the incorrect burn logic that inflates the LAXO balance of the LAXO/BUSD pair, then swaps the inflated LAXO for BUSD and repays the flash loan, keeping ~137K BUSD profit.
**Insight:** When a token's burn logic runs inside liquidity add/remove paths, check whether the pair's token balance can be inflated independently of reserves before a swap — the reserve/balance mismatch is the arbitrage surface.