# SKP Token: owner LP-burn backdoor inflates price for $212K

SKP token's owner-only ownerBurnLiquidityPairTokens burned LP-held SKP then sync() spiked the SKP/USDT price, letting the owner borrow ~$212K against inflated collateral.

- Payout: Real-world hack
- Severity: high
- Program: SKP Token
- Credited: DeFiHackLabs
- Disclosed: 2026-05-26
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/SKP_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260526-skp
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained technique:reverse-engineering technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** BEP-20 token with PancakeSwap LP and Venus/Lista lending
**Root cause:** SKP exposes an owner-only ownerBurnLiquidityPairTokens(uint256) that burns SKP held directly in the SKP/USDT pair; a subsequent sync() resets reserves to the depleted SKP balance while USDT stays intact, inflating the on-chain price.
**Steps:**
1. Fork BSC at block 100582079-1; confirm SKP.owner() == 0x041F52BFe9f07503EFc5E7d4d176336E48095D56
2. As owner, call `SKP.ownerBurnLiquidityPairTokens(95% of SKP.balanceOf(pair))`
3. Call `PAIR.sync()` on 0x47C8c3b123De467892aC7dF6Dfcf7CA3dB901733 to resync reserves
4. Observe SKP reserve slashed, USDT reserve unchanged, SKP/USDT price inflated ~20x
5. Supply over-valued SKP as collateral on Venus/Lista DAO and borrow BTCB + USDT (~$212K)
**How found:** PoC author decoded function selectors from bytecode (0x4eb9b26d ownerBurnLiquidityPairTokens, 0xfff6cae9 sync) and noticed the owner-only burn-from-LP backdoor plus 2% auto-burn/5% fee mechanics; public analysis states root cause was initially unknown.
**Exploitation:** Owner-privileged attacker burns ~95% of SKP inside the SKP/USDT PancakeSwap pair, calls sync() so reserves reflect the depleted SKP balance while USDT reserve is untouched, inflating SKP price ~20x; then deposits the over-valued SKP as collateral on Venus/Lista DAO and borrows BTCB and USDT, exiting with ~162,854 BSC-USD and 74.877 BNB (~$212K).
**Escalation:** Chained LP reserve manipulation into cross-protocol lending collateral inflation across PancakeSwap, Venus, and Lista DAO.
**Insight:** When reviewing tokens, decode selectors from bytecode for owner-only functions that touch the LP pair balance (burn-from-pair, skim, sync) — these let a privileged key directly rewrite reserves and thus oracle/lending collateral prices without any market trade.