# BCE: scheduledDestruction burn distorts Pancake pair reserves

BCE's scheduledDestruction accounting let an attacker burn the pair's BCE reserve via a transfer+sync, then sell into distorted reserves to drain ~800k USDT.

- Payout: Real-world hack
- Severity: critical
- Program: BCE
- Credited: DeFiHackLabs
- Disclosed: 2026-03-23
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/bce_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260323-bce
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token / PancakeSwap pair
**Root cause:** BCE records a scheduledDestruction amount during sells into its Pancake pair; a later ordinary transfer burns that amount directly from the pair and calls sync(), leaving the pair with almost no BCE reserve.
**Steps:**
1. Flash-loan USDT, BTCB, WBNB recursively from Moolah (Morpho-style) via nested flashLoan callbacks.
2. Deposit BTCB/WBNB as Venus collateral, enterMarkets, borrow all vUSDT cash.
3. Swap BCE out of the pair to accumulate scheduledDestruction, sell 90% back via fee-on-transfer router.
4. Trigger a transfer that burns scheduledDestruction from the pair and calls sync(), collapsing BCE reserve.
5. Sell remaining BCE into distorted reserves to extract USDT.
6. Repay Venus, redeem collateral, repay Moolah, forward profit.
**Exploitation:** Recursive Moolah flash loans fund a Venus collateral/borrow leg; two BCE flash swaps accumulate scheduledDestruction, which is burned from the pair via transfer+sync, then the attacker sells BCE into the near-empty reserve to drain the USDT side of the LP.
**Escalation:** Chained flash loans + Venus lending to amplify capital and drain the pair's USDT.
**Insight:** Deflationary/burn-on-transfer tokens that track a scheduledDestruction counter and burn from the pair on ordinary transfers can be weaponized: accumulate the counter via sells, then trigger the burn+sync to collapse reserves before dumping.