BFB token's custom price-defense deflationary logic could be triggered by zero-value transferFrom calls without per-transaction limits. An attacker used flash loans to repeatedly invoke the burn function ~151 times in one transaction, destroying BFB reserves and draining WBNB from the PancakeSwap liquidity pool.