# DTXT: liquidity misclassification fee bypass drains Pancake pair

DTXT token misclassified a large pair transfer as liquidity addition after a 1-wei USDT skew, bypassing sell fees to drain 35k USDT from the Pancake pair.

- Payout: Real-world hack
- Severity: high
- Program: DTXT
- Credited: DeFiHackLabs
- Disclosed: 2026-06-05
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/DTXT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260605-dtxt
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** BEP-20 token with custom transfer fee/liquidity-detection logic on PancakeSwap pair
**Root cause:** DTXT's transfer logic classifies a transfer to the Pancake pair as liquidity addition based on reserve skew (token0 balance vs reserve), so a 1-wei USDT transfer flips the classification and skips the sell fee.
**Steps:**
1. Flash loan USDT from Moolah sized to seed DTXT via `_flashAmountForSeed`.
2. Add USDT + half of helper's DTXT as liquidity via Pancake router, return remainder DTXT to helper.
3. Remove all minted LP to recover DTXT through DTXT's delete-liquidity branch.
4. Transfer `1` wei USDT to the pair to skew token0 balance vs reserve.
5. Transfer full DTXT balance to pair; DTXT treats it as add-liquidity, bypassing sell fee.
6. Call `pair.swap(usdtOut,0,...)` with `usdtOut = getAmountOut(dtxtIn, reserve1, reserve0)` against stale reserves.
7. Repay Moolah flash loan, forward remaining USDT profit to attacker.
**How found:** Attacker (or analyst) observed DTXT's transfer hook branches on pair reserve state; a 1-wei USDT transfer shifts token0 balance relative to reserve0, flipping the branch from sell to add-liquidity and skipping the fee.
**Exploitation:** Flash-borrow USDT, seed liquidity with pre-funded DTXT helper, remove LP, skew reserves by 1 wei USDT, dump DTXT into pair fee-free, swap out USDT against stale reserves, repay loan, keep ~35,041 USDT profit.
**Insight:** When a token's transfer hook branches on pair reserves/balances to decide fee vs liquidity-add, look for a cheap way to desync balance from reserve (1-wei transfer, direct donation) so a large dump is misclassified as liquidity and escapes the sell fee.