Attacker drains $578K from $LULA pool on PancakeSwap V2 by abusing privileged recycle() function

The exploit worked by abusing the Rental contract's privileged recycle() function, which can pull $LULA directly out of the PancakeSwap V2 pair and then call sync(), updating the pair's reserves to the manipulated balances. The attacker first made a large USDT-to-LULA swap to inflate the pair's USDT reserve, repeatedly triggered recycle() to shrink the LULA reserve, then swapped a small amount of LULA back to drain the LP, extracting roughly $578K. The incident was identified and analyzed by Phalcon.

✨ AI summary of the linked source — not editorial content.