# KRC: deflationary token skim desync drains PancakeSwap pair

KRC token's deflationary mechanics let attacker desync PancakeSwap pair reserves via repeated skim calls, extracting $7k in USDT.

- Payout: Real-world hack
- Severity: high
- Program: KRC
- Credited: DeFiHackLabs
- Disclosed: 2025-05-18
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-05/KRCToken_pair_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250518-krctoken-pair
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** PancakeSwap V2 pair for KRC token
**Root cause:** KRC token applies a fee on transfers, causing the pair's cached reserves to diverge from actual balances. Repeated transfer+skim cycles manipulate the reserve ratio without updating the pair's internal accounting correctly.
**Steps:**
1. Flash loan 248,157 USDT from DODO private pool.
2. Nested flash loan 100,000 USDT from PancakeV3 pool.
3. Swap 144,116 USDT to KRC via router (fee-on-transfer).
4. Swap 204,040 USDT to KRC via router.
5. Execute 17 cycles of: transfer small KRC amount to pair, then call `skim(address(this))`.
6. Call `krc_pair.swap(0, 355,361 USDT, address(this), new bytes(0))` to extract USDT.
7. Repay PancakeV3 flash loan 100,050 USDT.
8. Repay DODO flash loan 248,157 USDT.
**How found:** Likely identified that KRC's fee-on-transfer behavior combined with skim() allows reserve manipulation, as seen in similar deflationary token exploits.
**Exploitation:** Attacker used nested flash loans to obtain large USDT capital, swapped into KRC to imbalance the pair, then repeatedly transferred KRC to the pair and called skim to force reserve desynchronization. Finally swapped KRC for USDT at manipulated rate, repaying loans and keeping profit.
**Insight:** For tokens with transfer fees, repeatedly calling skim() after small transfers can desynchronize pair reserves from actual balances, enabling profitable swaps. Monitor pairs with non-standard token mechanics.