# Pair reserve desync via transfer hooks

Token hooks, burns or sync calls that move pair balances out of step with cached reserves

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2026-06-20. Updated 2026-10-24._

## How it works
An AMM pair caches reserves and trusts them to match its actual token balances. A token-side hook, burn, skim or sync call can move the pair's real balance without a proportional swap, so the cached reserve no longer reflects reality. The next swap, borrow or price read uses the stale or rewritten reserve, and value leaves the pool. The broken assumption: that only the pair's own swap logic changes its balances.

## Where it shows up
- `_transfer`/transfer hooks with branches keyed on `from == pair` or `to == pair`
- Amounts computed as `balanceOf(pair) - reserve` (or similar deltas) inside token code [E4](https://bugbountylibrary.com/r/dhl%3A20260526-skp-exp2.md)
- Owner-settable parameters (decimals, burn rates, whitelists) feeding burn/skim math [E1](https://bugbountylibrary.com/r/dhl%3A20260620-olpc.md)[E4](https://bugbountylibrary.com/r/dhl%3A20260526-skp-exp2.md)
- Owner-only functions that burn or move tokens held by the pair, followed by `sync()` [E2](https://bugbountylibrary.com/r/dhl%3A20260526-skp.md)
- Unverified helper/gateway contracts with opaque selectors touching a pair [E3](https://bugbountylibrary.com/r/dhl%3A20260618-jb.md)
- Auto-burn/fee mechanics combined with LP-held balances [E2](https://bugbountylibrary.com/r/dhl%3A20260526-skp.md)

## How to review
Identify every code path outside the pair that can change `balanceOf(pair)`. For each, check the invariant: after any token transfer, burn, skim or sync, `reserve == balanceOf(pair)` must hold, or the pair must be unable to trade until it does. Verify that no amount is derived from a live-balance-minus-reserve delta that an external actor can inflate within one transaction [E4](https://bugbountylibrary.com/r/dhl%3A20260526-skp-exp2.md). Decode selectors from bytecode for owner-only or unverified functions that touch the pair [E2](https://bugbountylibrary.com/r/dhl%3A20260526-skp.md)[E3](https://bugbountylibrary.com/r/dhl%3A20260618-jb.md). Confirm owner-settable parameters cannot make dust transfers produce outsized reserve changes [E1](https://bugbountylibrary.com/r/dhl%3A20260620-olpc.md).

## Variants seen
- Misconfigured decimals value makes dust transfers decay reserves, then zero-amountIn swap drains [E1](https://bugbountylibrary.com/r/dhl%3A20260620-olpc.md)
- Owner-only burn-from-pair plus `sync()` inflates price for over-borrowing [E2](https://bugbountylibrary.com/r/dhl%3A20260526-skp.md)
- Unverified helper loops sell/burn/sync against the pair to release the other asset [E3](https://bugbountylibrary.com/r/dhl%3A20260618-jb.md)
- Transfer hook sends unbounded treasury tokens to a whitelisted address when pair balance exceeds reserve [E4](https://bugbountylibrary.com/r/dhl%3A20260526-skp-exp2.md)

## Why fixes fail
Evidence shows owner-armed hooks and whitelists set shortly before drains [E4](https://bugbountylibrary.com/r/dhl%3A20260526-skp-exp2.md), and unverified helpers left callable [E3](https://bugbountylibrary.com/r/dhl%3A20260618-jb.md); patching one selector or parameter does not remove the balance/reserve desync path.

## Impact and severity
Drains ranged from ~49.9k USDT [E3](https://bugbountylibrary.com/r/dhl%3A20260618-jb.md) to 1.1M USDT [E1](https://bugbountylibrary.com/r/dhl%3A20260620-olpc.md) and ~$212K via inflated collateral [E2](https://bugbountylibrary.com/r/dhl%3A20260526-skp.md). Severity is critical: flash loans make the trigger atomic and cheap [E3](https://bugbountylibrary.com/r/dhl%3A20260618-jb.md)[E4](https://bugbountylibrary.com/r/dhl%3A20260526-skp-exp2.md), and privileged setup or unverified code makes detection harder.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260620-olpc.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260526-skp.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260618-jb.md
- E4: https://bugbountylibrary.com/r/dhl%3A20260526-skp-exp2.md