# JUDAO: sell-hook reserve drain via sync and burn

JUDAO's sell transfer hook burns pair reserves and syncs, letting an attacker flash-loan USDT, buy JUDAO, sell to drain reserves, then swap credited JUDAO for excess USDT.

- Payout: Real-world hack
- Severity: critical
- Program: JUDAO
- Credited: DeFiHackLabs
- Disclosed: 2026-04-28
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/JUDAO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260428-judao
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** JUDAO token contract and PancakeSwap JUDAO/USDT pair
**Root cause:** The JUDAO sell transfer hook calls sync(true) and isBurnPair reserve burns when tokens are sent to the pair, manipulating pair reserves without a swap. This credits the pair with JUDAO while reducing reserves, allowing a direct swap to extract excess USDT.
**Steps:**
1. Flash-loan USDT from Moolah sufficient to buy ~1/6 of JUDAO pair reserves.
2. Swap USDT for JUDAO via Pancake router, receiving JUDAO and recording tOwnedU credit.
3. Transfer the full JUDAO balance to the JUDAO/USDT pair, triggering the sell hook that burns reserves and syncs.
4. Read pair reserves; compute amountIn = judao.balanceOf(pair) - reserveJudao; compute amountOut via getAmountOut with 0.25% fee.
5. Call judaoPair.swap(amountOut, 0, attacker, "") to extract USDT.
6. Repay flash loan, convert part to 36 BNB, transfer remaining USDT to attacker.
**How found:** Likely identified by reviewing JUDAO's transfer hook logic, noticing that sending tokens to the pair triggers sync and burn operations that alter reserves without a swap, enabling a direct swap to extract value.
**Exploitation:** Attacker flash-loans USDT, buys JUDAO, transfers JUDAO to the pair to trigger the sell hook (sync and burn), then directly swaps the credited JUDAO for USDT at manipulated reserves, repays loan, and profits 205K USDT + 36 BNB.
**Insight:** When a token's transfer hook performs sync or burn on transfers to its liquidity pair, check if an attacker can send tokens to the pair to manipulate reserves and then swap directly for profit.