Skip to main content
• 5 min read

BFB Exploit: $198K Drained via
Deflationary Reserve-Burn Manipulation

$198K in WBNB was drained from the BFB/WBNB PancakeSwap pool on BNB Chain after a transfer hook repeatedly burned pool-side BFB reserves through zero-value self-transfers.

AUTOSEC.DEVAUTOSEC.DEV
BFB Exploit: $198K Drained via Deflationary Reserve-Burn Manipulation
  • Incident Date: July 8, 2026
  • Target: BFB / BFBToken
  • Target Overview: BFB is a BEP-20 token traded against WBNB through a PancakeSwap V2 pair on BNB Chain. The affected component was the BFB/WBNB LP pair 0xffB43C8A00A47B737d27b2aE59A35e269A21d040, which the BFB token contract references as its WBNB_Token_LP_Address.
  • Total Loss: Approximately $198,000, reported as about 350.6 WBNB
  • Reported Attacker Address: 0x3BFA85127C9871D3f74c30e36A618a77f0aE6b0F
  • Affected BFB Token Contract: 0x719699762fFCC7AadBdCec4E7cf03569E5e99999
  • Affected BFB/WBNB LP: 0xffB43C8A00A47B737d27b2aE59A35e269A21d040
  • Exploit Transaction: 0xabcf5c5c846595b2d0849f2579b67465ed8d06f3b469cee5e3a57c1f7aed3520
  • Attack Vector: Smart-contract logic flaw / deflationary reserve-burn manipulation / flash-loan-assisted AMM reserve manipulation

Incident Review & Technical Details​

1. Attack Path​

  1. The vulnerable token hook ran on ordinary transfers: The BFB token contract calls _priceDeflPool(from, to) during _transfer. BscScan source shows this function reads the current token price, compares it with fallLastPrice, and can burn tokens from the configured LP address when the price has fallen beyond the configured threshold.
  2. The "price defense" burned pool-side BFB: The public source shows fallPriceRatio = 500 and fallPriceBurnRatio = 500, both using DENOMINATOR = 10000. In practical terms, once the spot price moved more than 5% below fallLastPrice, _priceDeflPool() could burn 5% of the BFB balance held by the BFB/WBNB pair and then call sync() on the pair.
  3. The contract guard did not stop EOA-triggered loops: The burn branch only checked !isContract(from) && !isContract(to). According to Defimon Alerts, the attacker repeatedly satisfied that condition with zero-value EOA-to-EOA self-transfers using transferFrom(sender, sender, 0) between swaps.
  4. Flash-loan-funded rounds compounded the reserve distortion: Defimon reported roughly 151 flash-loan-funded rounds. Each cycle used the token's own reserve-burn mechanism to shrink the BFB side of the PancakeSwap pair, while sync() updated the cached reserves after the burn.
  5. The BFB reserve collapsed toward dust: As the BFB side was repeatedly burned from the LP, the pool's apparent BFB price inflated. Defimon reported that the attacker was then able to swap dust amounts of BFB for the pool's WBNB balance.
  6. The attacker drained WBNB from the LP: Defimon estimated the final loss at about 350.6 WBNB, or approximately $198,000, drained from the BFB/WBNB LP to the attacker.

2. Impact Scope​

  • Protocol-Level Loss: Approximately $198,000, reported as about 350.6 WBNB, was drained from the BFB/WBNB liquidity pool.
  • Affected Component: The affected component was the BFB token's transfer-time reserve-burn logic and its integration with the PancakeSwap V2 BFB/WBNB pair.
  • AMM State Impact: The repeated burns reduced the pair's BFB token balance and used sync() to make the pool's reserves follow that manipulated state.
  • PancakeSwap Scope: The reviewed evidence points to BFB token-side logic interacting with a PancakeSwap V2 pool, not a confirmed vulnerability in PancakeSwap core contracts.
  • On-Chain Evidence: BscScan records show the exploit transaction succeeded on BNB Chain at July 8, 2026, 18:08:51 UTC and include hundreds of BEP-20 transfers involving BFB, WBNB, the attacker, and the BFB/WBNB pair.
  • Disclosure Gap: No official BFB team statement, final postmortem, recovery announcement, or user-impact plan was identified in the reviewed public sources.

3. Official Statements​

  • BFB / BFBToken: No public official statement from the BFB team was identified in the reviewed sources at the time of writing.
  • Defimon Alerts: Defimon reported the incident as a BNB Chain logic-error exploit caused by deflationary reserve-burn manipulation, estimating the loss at about 350.6 WBNB or $198,000.
  • BscScan Records: BscScan confirms the exploit transaction, the attacker address, the affected LP address, and the public BFB token source code containing _priceDeflPool(), fallPriceRatio, fallPriceBurnRatio, and the sync() call.

4. Investigation Progress​

The exploit transaction, attacker address, BFB token contract, and BFB/WBNB LP pair are public. No confirmed fund recovery, white-hat negotiation, exchange freeze, or final technical postmortem was identified in the reviewed sources.

Recommended response steps for BFB-style deflationary-token pools:

  • Reproduce the 151-round loop on a BNB Chain fork and convert it into regression tests for zero-value transfers, transferFrom, price-threshold logic, reserve burns, and sync() behavior.
  • Remove or disable transfer-triggered burns from AMM pair balances; tokenomics mechanisms should not be able to burn liquidity-pool reserves based on manipulable spot prices.
  • Reject zero-value transfers from triggering stateful tokenomics hooks, especially hooks that update LP balances, burn supply, or call external pair contracts.
  • Replace spot-price "price defense" logic with bounded, time-weighted, and governance-reviewed mechanisms if such controls are required at all.
  • Add monitoring for repeated PriceDeflPool events, sudden LP-side token burns, balance/reserve divergence, abnormal sync() frequency, and flash-loan-amplified swap loops.
  • Publish a final incident report covering the exact vulnerable condition, affected LPs, fund-flow status, user impact, patch plan, and whether any contracts or trading routes should be considered unsafe.

AUTOSEC.DEV Solution​

BFB shows how a tokenomics feature can become an AMM drain when transfer hooks are allowed to mutate pool reserves and then force sync() under attacker-controlled transaction flow.

  1. Secure Code Review - The BFB exploit centered on _priceDeflPool() burning 5% of the LP-held BFB balance after a manipulable price move. AUTOSEC.DEV reviews token transfer hooks, burn mechanics, owner-configurable thresholds, AMM pair interactions, and external sync() calls to catch tokenomics logic that can break liquidity-pool invariants.
  2. Penetration Testing - The attacker reportedly chained about 151 flash-loan-funded rounds with zero-value self-transfers and swaps. AUTOSEC.DEV recreates these workflows on forked environments to test whether transfer hooks, AMM reserves, and router paths remain safe under adversarial sequencing.
  3. Incident Response - Because the loss is recent and the attacker address is public, response work should move quickly from root-cause replay into fund-flow tracing and disclosure support. AUTOSEC.DEV supports transaction reconstruction, exploit simulation, evidence packaging, exchange coordination, and post-patch validation.

Reference​