3. Vulnerability Analysis & Root Cause Summary

The vulnerability class is an attacker-driven treasury drain caused by using a manipulable AMM spot quote as a treasury redemption oracle. BurnsBuild computes deserved by calling Pancake's getAmountsOut(amount, [BurnsDeFi, WBNB]), which is only a snapshot of the current pool reserves. A flashloan-funded attacker can move those reserves immediately before calling burnToHolder, so the quoted WBNB output ceases to represent a manipulation-resistant valuation. BurnsBuild then forwards that inflated value into BurnsDeFi without any TWAP, cooldown, payout cap, or reserve sanity check. BurnsDeFi only checks that treasury balance is sufficient and then transfers the quoted BNB to BurnsBuild, making the treasury itself the settlement source for the manipulated price. Because BurnsBuild's reward redemption path is same-transaction and permissionless, the attacker can realize the payout before the manipulated price mean-reverts. The result is a deterministic drain of protocol-owned BNB funded entirely by public liquidity and public flashloan capital.

4. Detailed Root Cause Analysis

The critical pricing step lives in BurnsBuild:

address[] memory path = new address[](2);
path[0] = address(_burnsToken);
path[1] = uniswapRouter.WETH();

uint256 deserved = uniswapRouter.getAmountsOut(amount, path)[path.length - 1];
require(payable(address(_burnsToken)).balance >= deserved, "not enough balance");
_burnsToken.burnToholder(sender, amount, deserved);

In human terms, BurnsBuild prices a burn by asking the router what the current BurnsDeFi to WBNB spot output would be, then treats that quote as the amount of treasury BNB the burner deserves. That assumption is unsafe because the pair reserves are public and mutable within the same block. The attacker first borrowed 250000 USDT from the public DODO pool 0xd5f05644ef5d0a36ca8c8b5177ffbd09ec63f92f, then swapped through Pancake into BurnsDeFi, increasing the WBNB loaded into the BurnsDeFi pair and pushing the BurnsDeFi/WBNB price upward before the burn reward was calculated.

The treasury transfer itself happens in BurnsDeFi:

require(msg.sender == address(burnsHolder), "only burns");
require(launch, "unlaunch");
uint256 _amount = balanceOf(to);
require(_amount >= amount, "not enough");
super._transfer(to, address(burnsHolder), amount);
uint256 _balance = payable(address(this)).balance;
require(_balance >= balance, "Droped out");
payable(address(burnsHolder)).transfer(balance);

This code does not verify that balance is economically sound. It only checks that BurnsBuild is the caller, the user owns enough BurnsDeFi, and the treasury currently holds enough native BNB to fund the transfer. Once those checks pass, the BurnsDeFi treasury sends the requested BNB directly to BurnsBuild. The invariant that should have held was: treasury-backed burn payouts must remain bounded by a manipulation-resistant valuation and must not be computed from an attacker-controlled transient spot price. The concrete code-level breakpoint is BurnsBuild assigning deserved = getAmountsOut(...) and BurnsDeFi immediately settling that amount from treasury.

The supporting evidence is consistent. The seed balance diff shows BurnsDeFi's native balance moving from 334.456317385659142067 BNB to 45.097795719674116962 BNB, a net loss of 289.358521665985025105 BNB. The same artifact shows the attacker EOA 0xc9fbcf3eb24385491f73bbf691b13a6f8be7c339 ending with a net gain of 64324708722666231791969 smallest units of USDT, which is 64324.708722666231791969 USDT. The forge trace reproducing the incident shows the exact sequence: DODO flashloan, Pancake buy into BurnsDeFi, two burnToHolder calls, receiveRewards, conversion of redeemed BNB into WBNB and then USDT, flashloan repayment, and profit transfer.

5. Adversary Flow Analysis

The adversary cluster contained the transaction sender EOA 0xc9fbcf3eb24385491f73bbf691b13a6f8be7c339 and the helper contract 0xb5eebf73448e22ce6a556f848360057f6aadd4e7, which was the direct call target for the exploit transaction. The EOA initiated the transaction, and the helper contract executed the flashloan callback, swaps, burn calls, redemption, unwind, and repayment.

The flow was:

1. Borrow 250000 USDT from the public DODO pool using a flashloan.
2. Swap the borrowed USDT through Pancake into BurnsDeFi, materially changing the BurnsDeFi/WBNB pool reserves and inflating the instantaneous BurnsDeFi to WBNB quote.
3. Call BurnsBuild.burnToHolder twice with the acquired BurnsDeFi while the manipulated price is still active. BurnsBuild computes the reward from the manipulated AMM quote and forwards the corresponding BNB claim into BurnsDeFi.
4. BurnsDeFi transfers treasury BNB to BurnsBuild, and BurnsBuild records the attacker's reward entitlement.
5. Call BurnsBuild.receiveRewards to convert the accounting entry into spendable native BNB in the same transaction.
6. Wrap and sell the redeemed BNB and then sell remaining BurnsDeFi back into USDT, repay the flashloan principal, and forward the remainder to the attacker EOA.

The reproduced execution trace confirms that the exploit was fully permissionless and same-transaction. No owner role changes, governance actions, or special configuration updates were required. The only preconditions were publicly accessible liquidity, an adequately funded treasury, and BurnsBuild remaining configured as the burnsHolder.

6. Impact & Losses

The direct protocol loss was native BNB removed from the BurnsDeFi treasury. The measured loss from the balance diff was:

• 289358521665985025105 wei of BNB, which is 289.358521665985025105 BNB.

The attacker's realized profit was denominated in USDT after the unwind and loan repayment. The balance diff recorded a positive net change of 64324708722666231791969 USDT base units for the attacker EOA, or 64324.708722666231791969 USDT. The economic harm was therefore twofold: BurnsDeFi lost treasury-backed native assets, and the attacker extracted those assets into a liquid stablecoin profit within one transaction.

7. References

• Transaction: 0x1d0af3a963682748493f21bf9e955ce3a950bee5817401bf2486db7a0af104b4
• BurnsBuild verified source: 0x4fb9657ac5d311dd54b37a75cfb873b127eb21fd
• BurnsDeFi verified source: 0x91f1d3c7ddb8d5e290e71f893bad45f16e8bd7ba
• Public DODO flashloan pool: 0xd5f05644ef5d0a36ca8c8b5177ffbd09ec63f92f
• BurnsDeFi/WBNB Pancake pair: 0x928cd66dfa268c69a37be93bf7759dc8ee676bf8
• Validator-reviewed evidence: seed transaction metadata, balance diff, verified victim contract code, auditor oracle definition, and independent forge execution trace on a BSC mainnet fork.