POPA Recon#SKP / SKP-USDT on #BNB Chain was exploited for ~$212,195 after SKP's transfer-side market hook called sync() on the Pancake pair mid-swap…
#SKP / SKP-USDT on #BNB Chain was exploited for ~$212,195 after SKP's transfer-side market hook called sync() on the Pancake pair mid-swap and let the attacker drain nearly all pool USDT. Root cause: SKP's _transfer(address,address,uint256) could enter _runSpecialPairFlow(...), which conditionally called IPairLike(PANCAKE_PAIR).sync() during the token transfer path. That reserve refresh locked the pair at 205,184,395.144168 USDT versus 0.000000004 SKP immediately before the router's follow-up swap. Attacker EOA : 0x83b9e7edc5b3127e4853a4f4945b92aa88eef0c8 funded executor: 0xe924853dcdfcb89…
The excerpt is quoted from a public Telegram channel, which owns its text.