SKYDAO — Burn-from-pair + premature sync() drains PancakeSwap pool

Sep 28, 2026 the attacker wallet was funded with 0.01 BNB and began testing on PancakeSwap V3. Sep 30 at 14:03:26 UTC (block 124921242) a contract-creation transaction flash-borrowed 2,656,932.60 USDT from Moolah, bought SKY (435,367 USDT) and sent SKY to the pair. SKYDAO's 35% sell-tax path hands the gross amount to the pool controller, which sells the tax, burns the pair's SKY and calls sync() before the net sell is credited. A direct pair.swap() then drained the pair's whole 183,482.88 USDT side; the loan was repaid and 59,914.12 USDT went to the attacker EOA. The gap between the pair's loss and the attacker's net gain (about 123.6k USDT) is not explained publicly. DeFiHackLabs reproduced the attack on Oct 1-2. The profit has not moved since. No project statement was found.