OLPC/LABUBU PancakeSwap V2 Pool — Reserve Desync Drain

Timeline: T-46 days (~early May 2026): OLPC token owner alters the token's decimalsValue parameter and renounces ownership, planting a dormant trap. T0 (June 20, 2026, block 105326393, tx 0x8dabb60a94e5124462e5f494a25c14bcd52f6f4d1f7c665a249496f4c6c24764): Attacker contract 0x18D6c39a...3944fc188 sends a ~10 OLPC transfer through itself, which triggers a cascading sequence of LABUBU burns to the dead address (0x000...dEaD) from the OLPC/LABUBU pair, while the pair's cached AMM reserves are not resynced to the real, collapsed token balance. T0+seconds: Attacker exploits the mispriced pair, sweeping LABUBU at far below real cost and routing it through LABUBU/WBNB and WBNB/USDT pools. T0+minutes: Exit completed with 1,115,903.66 USDT (~$1,114,278.91) landing directly in the attacker's wallet. T+same day: PeckShieldAlert and @exvulsec publish technical alerts on X (June 20, 2026), confirming the vector as a deflationary/burn-on-transfer desync of a constant-product pair. PancakeSwap publicly states its own contracts were unaffected. T+same day: Attacker bridges proceeds to Ethereum and deposits 633.4 ETH into Tornado Cash. Status: no recovery, no patch possible (OLPC ownership renounced, contract immutable).