# DIP: fee-on-transfer reserve manipulation drains AIC pair

DIP's sell fee plus double router-transfer bug let attacker shrink DIP/AIC pair reserve via skim/sync, then drain AIC for 111k USDC profit.

- Payout: Real-world hack
- Severity: high
- Program: DIP
- Credited: DeFiHackLabs
- Disclosed: 2026-06-16
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/DIP_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260616-dip
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** DIP token / PancakeSwap AIC-DIP pair
**Root cause:** DIP's sell fee combined with a double router-transfer bug allowed the attacker to manipulate the pair's DIP reserve by transferring DIP and calling skim/sync, distorting the AIC reserve.
**Steps:**
1. Flash-swap 19,000,000 AIC from AIC/NEX Pancake pair via `swap(19000000e18, 0, attacker, data)`.
2. In callback, swap borrowed AIC to DIP through vulnerable DIP/AIC pair using router `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
3. Compute `dipInput = (dipNetToPair * 100) / (100 - 6)` where `dipNetToPair = DIP.balanceOf(pair) - 1`, transfer DIP to pair, then call `skim(router)` and `sync()`.
4. Swap remaining DIP back to AIC through distorted pair, repaying flash swap with `amount0 * 10000 / 9975 + 1` AIC.
5. Swap residual AIC to USDC and send to attacker.
**Exploitation:** Attacker flash-borrowed AIC, used DIP's sell fee and double router-transfer to inflate DIP balance in the AIC/DIP pair, skimmed excess DIP to router, synced to shrink DIP reserve, then swapped remaining DIP for nearly all AIC in the pair, repaid flash loan, and converted profit to USDC.
**Insight:** When a token has a sell fee and the pair is used with a fee-on-transfer router, check if transferring tokens directly to the pair then calling skim/sync can distort reserves because the router may double-transfer or misaccount fees.