# BYToken: permissionless triggerAutoBurn reserve manipulation drains pair

Permissionless triggerAutoBurn() let attacker corner BY supply, donate WBNB to hit trading threshold, burn pair reserves, then drain WBNB from BY/WBNB PancakeSwap pair.

- Payout: Real-world hack
- Severity: high
- Program: BYToken
- Credited: DeFiHackLabs
- Disclosed: 2026-06-04
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/BYToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260604-bytoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** BEP-20 token auto-burn mechanism on PancakeSwap pair
**Root cause:** triggerAutoBurn() is callable by anyone and burns BY from the pair, crashing the BY reserve; trading-enable threshold is reachable via a WBNB donation plus sync().
**Steps:**
1. Fork BSC at block 102329719-1; warp past lastBurnTimestamp + BURN_INTERVAL
2. Fund attacker with 422,497 WBNB; approve router for WBNB and BY
3. `swapExactTokensForTokensSupportingFeeOnTransferTokens(BUY1,0,wToBY,router,dl)` to corner BY supply (tokens discarded to router)
4. `WBNB.transfer(pair, DONATE)` then `PAIR.sync()` to push reserves past TRADING_ENABLE_BNB_THRESHOLD
5. `swapExactTokensForTokensSupportingFeeOnTransferTokens(BUY2,0,wToBY,this,dl)` to acquire BY
6. Call `BY.triggerAutoBurn()` to burn BY out of the pair and crash the BY reserve
7. Loop 5x `swapExactTokensForTokensSupportingFeeOnTransferTokens(1,0,byToW,this,dl)` to drain WBNB
8. Sell remaining BY balance via router to WBNB
**How found:** Source review of the BY token revealed triggerAutoBurn() lacked access control and burned from the pair; the trading-enable threshold was reachable by donating WBNB and calling sync(), enabling a reserve-manipulation sandwich.
**Exploitation:** Attacker flash-funded 422,497 WBNB, used router swaps to accumulate BY and donated WBNB to the pair to satisfy the trading-enable threshold, then invoked the permissionless triggerAutoBurn() which burned BY held by the pair, collapsing the BY reserve. With the skewed reserve ratio, tiny BY sells (1 wei repeated) extracted WBNB, and remaining BY was sold for a total ~146.60 WBNB (~$87,402) profit.
**Insight:** On tokens with auto-burn/liquidity-management functions, check whether burn/trigger functions are permissionless and whether they burn from the pair itself; a donation+sync() can satisfy gating thresholds, so reserve-crash-then-drain patterns apply.