# AIC: PancakeSwap pair skim reserve mismatch drains funds

AIC/NEX fee-on-transfer pair skimmed via flash-swap to collapse NEX reserve, then buy out AIC reserve for ~32.36 BNB profit.

- Payout: Real-world hack
- Severity: high
- Program: AIC
- Credited: DeFiHackLabs
- Disclosed: 2026-08-03
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-08/AIC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260803-aic
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** PancakeSwap V2-style pair (NEX/AIC) with fee-on-transfer tokens
**Root cause:** Fee-on-transfer tokens cause a mismatch between pair reserves and actual balances; the public skim() pays out the surplus, and sync() can be abused to collapse one reserve while the other remains large.
**Steps:**
1. Flash-swap ~42.98M AIC from USDC/AIC pair via `swap(0, flashAmt, address(this), data)`.
2. In callback, swap borrowed AIC to NEX via router `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
3. Transfer ~33.77M NEX back into NEX/AIC pair.
4. Call `skim(address(ROUTER))` then `sync()` on NEX/AIC pair, collapsing NEX reserve to ~1 while AIC reserve stays ~83.26M.
5. Swap retained NEX sliver (~19.35k) to buy ~83.26M AIC at wrecked ratio.
6. Repay flash swap with ~43.09M AIC (borrow + 0.26% fee).
7. Dump remaining ~40.17M AIC to USDC then WBNB via router, forwarding ~32.36 BNB to attacker.
**How found:** Likely identified fee-on-transfer tokens and public skim/sync functions as exploitable for reserve manipulation; reconstructed from on-chain trace.
**Exploitation:** Attacker flash-borrows AIC, manipulates NEX/AIC pair reserves via skim/sync, buys out AIC reserve cheaply, repays flash loan, and converts profit to BNB.
**Insight:** For fee-on-transfer tokens in Uniswap V2-style pairs, skim() and sync() can be used to artificially collapse one reserve, enabling cheap buyout of the other; look for pairs with such tokens and public skim/sync.