SKP — Token LP-Balance Drain + sync() Reserve Manipulation (Flash-Loan Amplified)

Timeline: On 27 May 2026, in a single transaction (0xbc01ea37...f25ee, BSC block 100582079), an attacker drained ~$212,850 (162,854.21 USDT + ~74.877 BNB) from the SKP/USDT market on PancakeSwap V2. The SKP token logic allowed extra SKP to be transferred out of the LP after a large buy; the attacker then called sync() to write incorrect reserves, pushing SKP reserves toward zero and letting USDT be extracted. The attack was amplified with flash loans from Lista DAO Moolah (BTCB and USDT) and a Venus borrow (~88M USDT against vBTC collateral). A two-contract structure was used: a trigger EOA (0x83B9e7ED...eF0C8) drove an attack contract (0xE924853D...5D7C1), which paid 1 BNB to BlockRazor for a MEV bundle and returned the net profit to the EOA. TenArmor detected and publicised the attack the same day (~$212K). Recovery: 0%. (BscScan displays transient values in the hundreds of millions for BTCB/USDT inside the transaction; these are flash-loaned amounts in transit and not the realised loss.)