# CashCowCoin: privileged burn in sell() drains PancakeSwap pair

CashCowCoin's public sell() calls a privileged burn of CCC from the PancakeSwap pair then sync(), letting an attacker repeatedly drain WBNB reserve for ~165 WBNB profit.

- Payout: Real-world hack
- Severity: critical
- Program: CashCowCoin
- Credited: DeFiHackLabs
- Disclosed: 2026-08-27
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-08/CashCowCoin_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260827-cashcowcoin
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan

**Target:** Solidity trading proxy + PancakeSwap V2 pair on BNB Chain
**Root cause:** The trading proxy's public sell() invokes a privileged CCC burn function (0xb20a0b6f) that burns post-tax CCC directly out of the pair, then calls pair.sync(). The burn selector is gated to the proxy, but the proxy's own public sell() exposes it to anyone, so each sell removes CCC from the pair and re-syncs, keeping CCC reserve flat while bleeding WBNB.
**Steps:**
1. Flash-loan 416,831.487 WBNB from Moolah lending pool.
2. Donate 13,999.890 WBNB to the CCC/WBNB pair and call `pair.sync()` to inflate WBNB reserve as working float.
3. Call `proxy.buy{value: 402,831.596 BNB}(BUY, 0, deadline)` to receive 8,805,839.807 CCC.
4. Approve proxy for CCC and call `proxy.sell(chunk, 0, deadline)` 80 times with chunk = stack/80; each sell swaps CCC->WBNB to attacker, then proxy burns ~104,569 CCC from pair via 0xb20a0b6f and syncs.
5. Wrap all BNB proceeds to WBNB, repay flash loan, keep ~165.47 WBNB profit.
**How found:** Likely identified by reading the proxy's sell() logic and noticing it calls a privileged burn selector on the token followed by pair.sync(), which is exploitable because sell() is public and permissionless.
**Exploitation:** Attacker flash-loans large WBNB, seeds the pair to provide float, buys CCC, then loops sell() calls. Each sell triggers the proxy's privileged burn of freshly-arrived CCC from the pair followed by sync(), ratcheting the pair's WBNB reserve down from 165.49 to 0.0179 while CCC reserve stays ~326,767. Attacker extracts the WBNB difference as profit.
**Escalation:** Repeated 80 sell cycles amplify the drain; seeding the pair with extra WBNB improves efficiency of each cycle.
**Insight:** When a public entry point calls a privileged token function (burn/mint) that mutates AMM reserves, check whether the subsequent sync() lets you repeatedly extract value by keeping one reserve flat while draining the other.