# YSDAO: tax bypass and price manipulation via Staking.sync()

YSDAO token's tax logic misread pair balances, letting attacker bypass buy/sell taxes and manipulate price via unauthenticated Staking.sync() to drain ~19.49K USDT.

- Payout: Real-world hack
- Severity: high
- Program: YSDAO
- Credited: DeFiHackLabs
- Disclosed: 2026-05-29
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/YSDAO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260529-ysdao
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:access-control vuln:business-logic vuln:fee-bypass vuln:oracle-manipulation

**Target:** BEP-20 token and staking contract on BSC
**Root cause:** YSDAO's transfer tax logic determines add/remove liquidity by comparing pair token balances to reserves, which can be spoofed by manipulating swap output and direct transfers. Staking.sync() lacks access control and donates staking-held USDT to the pair, inflating price.
**Steps:**
1. Flash loan 8,000,002 USDT from Pancake V3 USDT/WBNB pool.
2. Call YSDAO/USDT pair.swap(1, ysdaoOut, attacker, data) to buy YSDAO while outputting 1 wei USDT, making _isRemoveLiquidity() true and skipping buy tax.
3. Call Staking.sync() to transfer all staking-held USDT into the pair and sync reserves, raising YSDAO price.
4. Transfer 1 USDT directly to the pair to make _isAddLiquidity() true before selling.
5. Approve and sell all YSDAO via Pancake router swapExactTokensForTokensSupportingFeeOnTransferTokens, bypassing sell tax.
6. Repay flash loan and keep ~19.49K USDT profit.
**How found:** Likely identified that YSDAO's tax logic relies on pair balance vs. reserves, which can be manipulated by controlling swap output and direct transfers. Also noticed Staking.sync() was callable by anyone and moved staking USDT into the pair.
**Exploitation:** Attacker used a V3 flash loan to fund a V2 pair swap that manipulated the token's tax detection, then called Staking.sync() to inflate the pair's USDT reserves, and finally sold YSDAO with a direct USDT transfer to bypass sell tax, extracting ~19.49K USDT.
**Insight:** When a token's tax logic checks pair balances against reserves, try to spoof those conditions by outputting minimal amounts or direct transfers. Look for unauthenticated sync/donate functions that can inflate reserves.