# AIDC: transfer-triggered pair burn deflates reserves for profit

AIDCToken burns accumulated sell-side amounts directly from the AMM pair on ordinary transfers, letting an attacker repeatedly deflate the pair's AIDC reserve and drain ~220 WBNB.

- Payout: Real-world hack
- Severity: high
- Program: AIDC
- Credited: DeFiHackLabs
- Disclosed: 2026-06-28
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/AIDC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260628-aidc
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token AIDCToken and its PancakeSwap V2 AIDC/WBNB pair
**Root cause:** AIDCToken applies its sell-side burn by burning accumulated amounts directly out of the AMM pair's AIDC balance on ordinary transfers, rather than only from the seller's own balance. This lets any transfer shrink the pair's AIDC reserve without a matching swap.
**Steps:**
1. Flash-borrow 200 WBNB from Pancake V3 USDT/WBNB pool via `flash()`.
2. Claim pending AIDC reward dust by sending 0.00001 BNB to AIDC, then seed a tiny AIDC/WBNB LP position via `pair.mint`.
3. Unwrap 100 WBNB, buy AIDC through Pancake V2 router with `swapExactETHForTokensSupportingFeeOnTransferTokens`.
4. Remove a small LP slice via `removeLiquidityETHSupportingFeeOnTransferTokens` to forward AIDC back and trigger burn/sync.
5. Loop 13 times: deploy a fresh `AIDCSellHelper`, transfer AIDC to it, have it `transfer` AIDC to the pair (triggering burn from pair reserves), then `pair.skim(router)` and remove another LP slice.
6. Final helper swaps remaining AIDC to BNB via `swapExactTokensForETHSupportingFeeOnTransferTokens`.
7. Wrap proceeds, repay flash loan + fee, tip builder 1 BNB, forward profit to attacker.
**How found:** Researcher observed that AIDCToken's burn accounting lets ordinary transfers burn accumulated sell-side amounts from the pair itself rather than the sender, meaning any transfer into the pair deflates reserves without a swap — exploitable by repeatedly transferring in and skimming.
**Exploitation:** Attacker flash-borrows 200 WBNB, seeds a minimal LP position, then repeatedly uses fresh helper contracts to transfer AIDC into the pair. Each transfer triggers AIDCToken's sell-side burn logic which burns AIDC directly from the pair's balance, deflating the AIDC reserve. After each burn the attacker skims and removes liquidity at the now-favorable rate, extracting WBNB. Fresh helpers bypass per-address cooldown. Net ~220.13 WBNB profit.
**Escalation:** Fresh helper contract per iteration bypasses per-address cooldown; loop of 13 iterations compounds the reserve deflation. Final sell capped to avoid emptying reserve entirely.
**Insight:** When a token's fee/burn logic references 'accumulated' amounts, check whether the burn is debited from the pair's balance instead of the sender's — that turns any transfer into a free reserve-deflation primitive. Fresh-contract-per-iteration also defeats per-address cooldowns.