On January 30, 2023, the BEVO reflection token on BSC was exploited. The attacker took a flash loan of 192.5 WBNB, swapped for BEVO tokens, and invoked the deliver function which decreased the _rTotal value. This manipulation of the deflationary mechanism allowed the attacker to profit approximately $45K.

The BEVO NFT Art Token (BEVO) on BSC was exploited with a total loss of approximately $45,000. The root cause is that BEVO is a deflationary token, and the attacker calls the function deliver(), the value of _rTotal will decrease, which will further affect the return value of getRate() used to calculate the balance. After the attacker manipulates the token balance, he calls the function skim to transfer the increased PancakePair balance to his own account. Finally, the attacker calls the function deliver() again and exchanges the increased BEVO back to WBNB.