# DogeAlliance: LP reserve desync via dust transfer and sync()

Attacker flash-borrowed WBNB, dusted three DOGEALLY LPs with 1 wei and called sync(), then swapped against skewed reserves for profit.

- Payout: Real-world hack
- Severity: medium
- Program: DogeAlliance
- Credited: DeFiHackLabs
- Disclosed: 2025-05-31
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-05/DogeAlliance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250531-dogealliance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** DOGEALLY token liquidity pools on BSC (PancakeSwap pairs)
**Root cause:** DOGEALLY LP reserves could be forcibly desynchronized by direct token transfers followed by permissionless sync(), allowing swaps against reserves with one wei of DOGEALLY and large paired-token balances.
**Steps:**
1. Flash-borrow 0.01 WBNB from DODO DPP.
2. Swap WBNB -> CAKE -> DOGEALLY on Pancake Router.
3. For each of three DOGEALLY pairs (WBNB, BUSD, WBNB_2): transfer 1 wei DOGEALLY to the pair, then call `sync()`.
4. Split remaining DOGEALLY into three chunks; swap each through the manipulated pairs via routers to extract WBNB and BUSD.
5. Swap extracted BUSD -> WBNB; repay flash loan; send profit to receiver.
**How found:** Likely identified that sync() is permissionless and that direct token transfers can manipulate reserves; tested by sending 1 wei and syncing to create extreme price skew.
**Exploitation:** Attacker used a flash loan to acquire DOGEALLY, then for each target pair transferred 1 wei of DOGEALLY directly to the pair and called sync(), forcing the pair's reserves to reflect a tiny DOGEALLY balance and large paired-token balance. Subsequent swaps sold DOGEALLY at an inflated price, draining WBNB and BUSD from the pools.
**Insight:** On Uniswap V2 forks, any pair with a permissionless sync() can be manipulated by direct token transfers; check if a token's transfer logic or pair sync allows forcing reserves to near-zero on one side, especially for low-liquidity tokens.