UPS Sell Hook Drains Pancake Pair

3. Vulnerability Analysis & Root Cause Summary

The vulnerability is an attack-class logic flaw in AiWGPTToken's sell hook. The contract exposes protocol-owned LP withdrawal on an unprivileged sell path and sizes that withdrawal using a price proxy derived from IERC20(address(this)).balanceOf(swapLPAddr), which is the pair's instantaneous WGPT balance. That value is directly movable by any trader who buys from the pair in the same transaction. Once the attacker lowers the pair's visible WGPT balance, callPrice() falls and (_value * 1e18 / callPrice()) + lpNumber grows, causing removeLp() to burn more protocol LP than intended. The withdrawn USDT and WGPT are then consumed by usdtToToken() and burnToekn(), leaving the pair with lower reserves and the token contract with far less LP. The broken invariant is that an unprivileged seller must never be able to trigger protocol LP removal in an amount derived from a transient, attacker-manipulable spot balance.

4. Detailed Root Cause Analysis

The vulnerable code path in the verified AiWGPTToken source is:

function transferFrom(address _from, address _to, uint256 _value) public returns (bool success) {
    ...
    if(_swapPairList[_to]){
        if(isSwap || _WhiteList[_from]){
            if(burnToken){
                sellburnToken(callBurn(_value));
            }
            ...
        }
    }
}

function callPrice() private returns(uint256){
    uint256 tokenBalance = IERC20(address(this)).balanceOf(swapLPAddr);
    tokenBalance = tokenBalance * 10 ** 18;
    uint256 lpBalance = IERC20(swapLPAddr).totalSupply();
    lpPrice = tokenBalance / lpBalance;
    return lpPrice * 2;
}

function sellburnToken(uint256 _value) private returns(bool){
    (uint amountA, uint amountB) = removeLp((_value * 10**18 / callPrice()) + lpNumber);
    usdtToToken(_value - amountB);
    burnToekn(amountB);
    return true;
}

The exploit sequence follows directly from that code:

1. Start from BSC block 29891709, where isSwap=true, burnToken=true, swapLPAddr already points to the public WGPT/USDT pair, and the token contract still owns a large LP position.
2. Borrow public USDT liquidity through DODO and buy WGPT from the pair. This reduces IERC20(address(this)).balanceOf(swapLPAddr), which is the exact input used by callPrice().
3. Sell WGPT back into the pair through PancakeRouter. Each sell reaches transferFrom() with _to equal to the pair, so the token invokes sellburnToken().
4. Because callPrice() is now artificially depressed, removeLp() withdraws excessive protocol LP from the pair.
5. The withdrawn assets are partially recycled through usdtToToken() and burnToekn(), while the attacker exits the sell path with positive USDT.

The incident trace shows the repeated LP-removal breakpoint clearly. During the exploit transaction, PancakeRouter repeatedly executes:

PancakeRouter::removeLiquidity(
  BEP20USDT,
  AiWGPTToken,
  4448262008380174093090,
  10,
  10,
  AiWGPTToken,
  1689146288
)
...
PancakeRouter::removeLiquidity(
  BEP20USDT,
  AiWGPTToken,
  2137068849583674609242,
  10,
  10,
  AiWGPTToken,
  1689146288
)

The balance-diff evidence confirms the final state change caused by that path:

{
  "token": "0x5a596eae0010e16ed3b021fc09bbf0b7f1b2d3cd",
  "holder": "0x1f415255f7e2a8546559a553e962de7bc60d7942",
  "before": "93671278471332372231927",
  "after": "5023736168813373194",
  "delta": "-93666254735163558858733"
}

The same balance diff shows both pair reserves draining materially:

{
  "token": "0x55d398326f99059ff775485246999027b3197955",
  "holder": "0x5a596eae0010e16ed3b021fc09bbf0b7f1b2d3cd",
  "delta": "-105212230996130493027690"
}
{
  "token": "0x1f415255f7e2a8546559a553e962de7bc60d7942",
  "holder": "0x5a596eae0010e16ed3b021fc09bbf0b7f1b2d3cd",
  "delta": "-81017855558625925684802"
}

5. Adversary Flow Analysis

The adversary cluster consists of EOA 0xdc459596aed13b9a52fb31e20176a7d430be8b94 and helper contract 0x5336a15f27b74f62cc182388c005df419ffb58b8. The EOA deployed the helper in transaction 0xfcf00c61684f0883a8311dd6f1c1a5c7160ef0ad47686a25c21ed709d94bb171, approved an auxiliary token in transaction 0x868c39fedb968ce2bc30224c2cb6b57c01010c6de193c42ce09476738e9eee75, and then sent the exploit transaction.

In the exploit transaction:

1. The helper borrows public liquidity through DODO flash loans.
2. The borrowed USDT is routed into a WGPT buy, lowering the pair's live WGPT balance.
3. The helper performs repeated sells through PancakeRouter instead of one full-balance sell; this keeps the vulnerable sell hook executable while avoiding the router-side revert noted in the reproduction.
4. Each sell triggers AiWGPTToken's sellburnToken() path, which repeatedly removes protocol LP from the pair.
5. After repayment, the attacker retains positive USDT while the protocol loses LP and both sides of the pair are depleted.

The validator reproduction on a mainnet fork reaches the same semantic outcome: LP falls from 93671278471332372231927 to 81571368139716878044820, reserves fall to 135984835161388795441113 WGPT and 243788242260001548332149 USDT, and the attacker retains 3623222550076100488813 USDT after repaying the flash loan principal.

6. Impact & Losses

The incident drained protocol-owned LP and reduced both reserves in the public WGPT/USDT pool. The measured losses reported in the root-cause package are:

• USDT: 105212230996130493027690
• WGPT: 81017855558625925684802
• WGPT-USDT-LP: 93666254735163558858733

Operationally, the protocol lost nearly all LP held by the token contract for the victim pair, burned a large amount of WGPT, and ended with materially depleted public market liquidity.

7. References

• Incident transaction: 0x258e53526e5a48feb1e4beadbf7ee53e07e816681ea297332533371032446bfd
• Victim token: 0x1f415255f7e2a8546559a553e962de7bc60d7942
• Victim pair: 0x5a596eae0010e16ed3b021fc09bbf0b7f1b2d3cd
• Verified AiWGPTToken source used for breakpoint analysis
• Incident opcode trace used for flash-loan and repeated removeLiquidity evidence
• Incident balance diff used for reserve and LP depletion confirmation
• Address history for 0xdc459596aed13b9a52fb31e20176a7d430be8b94 used for adversary clustering