# BOSS: helper mint/burn skews Pancake pair for USDT drain

BOSS helper mint/burn plus transfer-tax accounting let attacker skew the BOSS/USDT pair to 10 BOSS and drain 10,207 USDT via repeated taxed swaps.

- Payout: Real-world hack
- Severity: high
- Program: BOSS
- Credited: DeFiHackLabs
- Disclosed: 2026-06-06
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/BOSS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260606-boss
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token helper and PancakeSwap BOSS/USDT pair on BSC
**Root cause:** BOSS helper userMint/userBurn let the attacker arbitrarily inflate and then burn the pair's BOSS reserve, and the transfer-tax accounting on swaps let the pair receive a net amount inconsistent with the reserve used for pricing.
**Steps:**
1. Flash loan 1,250,000 USDT from Moolah.
2. Call `BOSS_HELPER.userMint(100_000e18)` to mint BOSS and seed BOSS/USDT liquidity.
3. Swap remaining USDT to BOSS via Pancake router with BOSS_HELPER as recipient.
4. Read pair BOSS balance, call `BOSS_HELPER.userBurn(pairBossBalance - 10)` leaving 10 BOSS in pair.
5. Loop 155x: read reserves, `BOSS.transfer(pair, bossReserve/10)`, compute `getAmountOut(netBossIn, bossReserve, usdtReserve)`, call `pair.swap(usdtOut, 0, this, '')`.
6. Repay flash loan and transfer USDT profit to attacker EOA.
**Exploitation:** Attacker flash-borrowed 1.25M USDT, used helper mint to add BOSS liquidity, swapped USDT into BOSS, then burned nearly all pair BOSS leaving 10 tokens. With the pair skewed, each loop transferred bossReserve/10 BOSS (taxed on transfer) into the pair and swapped out USDT priced against the pre-transfer reserve, repeating 155 times to extract 10,207.54 USDT.
**Insight:** When a token has a helper contract that can mint/burn against a live AMM pair, check whether burning the pair's reserve to dust lets you exploit the gap between the reserve used for pricing and the post-tax amount actually received by the pair.