# AISOTHPresale: fixed-price presale arbitrage drains 30k USDT

AISOTHPresale sold AIS at a fixed price below market, letting an attacker flash-borrow USDT, buy the entire presale inventory, claim, and sell for profit.

- Payout: Real-world hack
- Severity: high
- Program: AISOTHPresale
- Credited: DeFiHackLabs
- Disclosed: 2026-06-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/AISOTHPresale_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260605-aisothpresale
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Presale contract on BSC
**Root cause:** The presale contract sold AIS at a fixed price() that was lower than the market price on the AIS/USDT Pancake pair, and allowed buying the entire remaining inventory in a single transaction without any per-user cap or time-based restriction.
**Steps:**
1. Flash-swap USDT from the USDT/WBNB Pancake pair: `loanPair.swap(borrowAmount, 0, address(this), bytes("1"))` where borrowAmount = presaleAisBalance * price / 1e18.
2. In the pancakeCall callback, approve USDT to presale and call `presale.buy(amount0)` to purchase all remaining AIS.
3. Call `presale.claim()` to receive the AIS tokens.
4. Approve AIS to Pancake router and swap all AIS for USDT via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
5. Repay the flash swap with 0.25% fee: `usdt.transfer(USDT_WBNB_PAIR, repayment)`.
6. Transfer remaining USDT profit to attacker EOA.
**How found:** Likely identified by comparing the presale's fixed price() to the AIS/USDT Pancake pair market price and noticing the presale held a large claimable AIS balance that could be bought in one transaction.
**Exploitation:** Attacker flash-borrowed enough USDT to buy the entire AIS inventory from the presale at the fixed price, immediately claimed the AIS, sold it on the AIS/USDT Pancake pair at market price, repaid the flash loan, and kept the difference (~30,314 USDT).
**Insight:** Check presale/IDO contracts for fixed price() vs DEX market price discrepancies and whether the entire remaining inventory can be bought atomically; flash loans make such arbitrage risk-free.