LULA Token — EIP-7702 Delegation & Reserve Manipulation Exploit

Per CertiK's analysis, the attacker begins preparing helper contracts well in advance of the exploit. T0

July 28, 2026 (transaction 0xa219ab9d57e520e5235b15a8801f4ebac8cc45551be0430ce4e49caea0411d7c, block 112655390): The attacker (0x2677806d48325Ced7533C54B86eD5e99b129a4ED) initiates a single complex transaction, aggregating flash loans across at least eight sources — Lista DAO Moolah (4.4M USDT + 407K WBNB), Aave V3 (40K WBNB deposited as collateral, 14.6M USDT borrowed against it), Venus (64.9M USDT + WBNB), PancakeSwap Infinity Vault, Uniswap V4 Pool Manager, and seven PancakeSwap V3 pools ranging from ~60K to ~29M USDT each — for a combined nominal flash-loan volume of ~$237M. A large 197M USDT swap into LULA on the PancakeSwap V2 LULA/USDT pool (0xF0b36389...76889D6a96) sharply skews the pool's reserves. The attacker then repeatedly invokes the LULA token's privileged recycle() function — restricted to the project's Rental contract, but reachable via an EIP-7702 account delegation (delegated contract 0x377a015f44C3FDf71060e94648EDC9e0316C7f1a, EOA 0x2a6Cf8592D1CC22BEd916481bb745ccAf80aE6F1) — through repeated calls to claimTeamReward(), each call transferring LULA directly out of the pool and forcing a sync() to lock in the manipulated reserve balances. This loop is executed hundreds of times across multiple auxiliary accounts within the same transaction, systematically draining the pool. All flash loans are fully repaid within the same transaction, and the attacker walks away with a net profit of 578,295.907588 USDT (~$577,699.11), sent directly to the attacker address. TenArmor is the first to flag the attack publicly, sharing the transaction hash. BlockSec Phalcon and CertiK publish detailed technical breakdowns on July 29, 2026, with CertiK confirming the 12-day advance preparation and BlockSec Phalcon detailing the recycle()/sync() reserve-manipulation mechanism. The incident adds to a pattern of recurring BSC exploits in 2026 driven by cheap, unaudited contract deployment; no funds have been recovered and the attacker remains unattributed.