# OLPC: decimalsValue misconfig enables pair reserve manipulation drain

OLPC token's decimalsValue misconfiguration let dust transfers decay pair reserves, enabling a zero-amountIn Pancake swap to drain 1.1M USDT.

- Payout: Real-world hack
- Severity: critical
- Program: OLPC
- Credited: exvulsec
- Disclosed: 2026-06-20
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/OLPC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260620-olpc
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:precision-loss

**Target:** BEP-20 token transfer hook + PancakeSwap V2 pair/router
**Root cause:** OLPC owner set decimalsValue to 7326680472586200649, so the transfer hook's burn/skim math let tiny dust transfers force large pair balance decay; the pair reserve could then be desynced from actual balance.
**Steps:**
1. Fork BSC at block 105326392; fund attacker with ~10.14 OLPC.
2. Transfer 1 OLPC to OLPC/LABUBU pair to seed.
3. Compute dustTransfer via _initialDustTransfer targeting 10% balance using decimalsValue().
4. Loop 20x: `pair.sync()`, transfer dustTransfer OLPC to pair, `pair.skim(SKIM_RECEIVER)`, divide dustTransfer by 10.
5. Final `pair.sync()` then transfer 9 OLPC to pair leaving ~8.1 OLPC excess over reserve.
6. Call `bridgeRouter.swap(OLPC, 0, 1, USDT, attacker, deadline)`; Pancake swapExactTokensForTokensSupportingFeeOnTransferTokens with amountIn=0 reads excess OLPC balance as input, releases LABUBU.
7. Route LABUBU->WBNB->USDT via proxy swap; assert profit > 1,000,000 USDT.
**How found:** Researcher noticed the owner-set decimalsValue (7326680472586200649) made the transfer hook's burn math produce outsized reserve decay from dust transfers, then chained sync/skim with a zero-amountIn Pancake swap to extract value.
**Exploitation:** Attacker used a tax-exempt proxy to bypass LABUBU fees, repeatedly synced/skimmed the OLPC/LABUBU pair to decay reserves, then invoked a bridge router whose swap passed amountIn=0 to Pancake; Pancake inferred input from the pair's excess OLPC balance, releasing LABUBU that was routed through WBNB into USDT for ~1.1M profit.
**Escalation:** Repeated sync/skim cycles amplified reserve decay; tax-exempt proxy avoided transfer fees on the LABUBU leg.
**Insight:** When a token's transfer hook derives burn/skim amounts from an owner-settable decimalsValue, check whether tiny transfers can desync a pair's stored reserve from its actual balance; a subsequent swap with amountIn=0 will read the excess balance as free input.