LABUBU lost $1.11M to a logic error exploit on BNB Chain where an attacker drained 688K tokens by exploiting OLPC's burn-on-transfer mechanic combined with PancakeSwap's skim() function.
Security & Exploits ·
An attacker exploited a logic error in the LABUBU/OLPC liquidity pair on BNB Chain, draining approximately 688,000 LABUBU tokens worth roughly $1.11 million. The exploit leveraged OLPC's burn-on-transfer mechanism, which reduces token balances when moved, combined with PancakeSwap's skim() function that allows anyone to claim imbalanced reserves.
The attack worked by repeatedly transferring small amounts of OLPC into the pair, triggering the burn mechanism and creating a reserve mismatch between the two tokens. The attacker then called sync() to refresh the pair's recorded reserves and skim() to extract the now-surplus LABUBU side. Across approximately 20 iterations, this process accumulated roughly 688,000 LABUBU tokens, which were subsequently sold through PancakeSwap's LABUBU/WBNB and WBNB/USDT routes for approximately $1.11 million USDT.
The core vulnerability stems from the interaction between OLPC's deflationary design and Uniswap V2's standard skim() function, which was not designed to account for tokens that automatically reduce balances during transfers. The reserve mismatch created by the burn created an arbitrage opportunity that any user could exploit. It remains unclear whether LABUBU or OLPC contract maintainers have issued patches or whether affected liquidity providers have recovered any losses.