# ARK: autoBurnLiquidityPairTokens reserve desync drains WBNB pair

ARK's autoBurnLiquidityPairTokens repeatedly burned pair-held ARK, desyncing reserves so attacker swapped ARK for ~348 BNB.

- Payout: Real-world hack
- Severity: high
- Program: ARK
- Analysis by: DeFiHackLabs
- Disclosed: 2024-03-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-03/ARK_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240324-ark
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BEP-20 token autoBurnLiquidityPairTokens and ARK/WBNB PancakeSwap pair
**Root cause:** autoBurnLiquidityPairTokens burns ARK from the liquidity pair without syncing the pair's reserves, so the pair's cached reserves diverge from actual token balances.
**Steps:**
1. Fork BSC at block 37221235; fund attacker with 100 WBNB and 4 ARK.
2. Loop up to 10,000 times calling `ARK.autoBurnLiquidityPairTokens()` until `ARK.balanceOf(ARK_WBNB)` drops below 1,700,000,000,000.
3. Transfer 100 WBNB and remaining ARK to the ARK_WBNB pair to inflate its ARK balance vs stale reserves.
4. Read `ARK_WBNB.getReserves()`; compute `amountOut = router.getAmountsOut(ARK.balanceOf(pair) - reserve1, [ARK, WBNB])`.
5. Call `ARK_WBNB.swap(amountOut[1], 0, attacker, "")` to extract WBNB.
**How found:** Likely spotted that autoBurnLiquidityPairTokens is externally callable and burns pair tokens without calling sync(), letting reserves desync from balances.
**Exploitation:** Attacker repeatedly invoked the public burn function to shrink the pair's ARK balance while reserves stayed stale, then donated ARK/WBNB to the pair and swapped against the desynced reserves, extracting ~348 BNB.
**Insight:** Look for externally callable burn/donate functions that move tokens out of a Uniswap V2 pair without sync(); repeated calls desync reserves and enable a swap against stale pricing.