AIDC burn bug lets attacker drain 220.12 WBNB from PancakeSwap pair by abusing sync()

SlowMist says AIDC on BSC was exploited for 220.12 WBNB, about $120,929, after `_sellTransfer()` accrued a 30% burn amount without deducting it from the seller. Subsequent non-pair transfers called `_executeAccumulatedBurn()`, burning tokens from the PancakeSwap AIDC/WBNB pair instead of the user, then `sync()` made the manipulated reserves official. The attacker repeatedly deflated the pool’s AIDC reserve before a final swap drained nearly all WBNB from the pair.

TLDR by @Benthic

Explore the topic

• Burn