# LULA: recycle() drains pair reserve via reward claims

LULA's Rental reward claims call recycle(), which pulls LULA from the PancakeSwap pair and sync()s without USDT leaving, letting an attacker drain the LULA reserve and buy back cheaply for ~578K USDT.

- Payout: Real-world hack
- Severity: critical
- Program: LULA
- Credited: DeFiHackLabs
- Disclosed: 2026-07-28
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-07/LULA_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260728-lula
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC token contract + PancakeSwap V2 pair + Rental reward contract
**Root cause:** LULA.recycle(), callable only by Rental, moves up to a third of the pair's LULA to Rental via raw _basicTransfer and calls pair.sync(), shrinking the LULA reserve with no USDT paid back. Separately, buyEnabled is bypassed when sender/recipient is fee-excluded, letting a swap output route to the owner address.
**Steps:**
1. Accrue team/referral rewards in Rental via helper contracts ~12 days prior.
2. Flash-borrow ~197.05M USDT from 15 sources (Moolah, Aave V3, Venus, Pancake Infinity Vault, Uniswap v4, ten V3 pools).
3. Sell 5,000 LULA, then swap all USDT for LULA with output sent to fee-excluded LULA owner `0x43721aBC...` to bypass buyEnabled; pair goes to 197.64M USDT / 24,022 LULA.
4. Call claimTeamReward()/claimReferralReward() on helpers so Rental loops recycle() up to 10 rounds, draining pair LULA from 24,022 to 0.0044 while USDT stays 197.64M.
5. Sell 4,999 LULA back into the pair for 197,642,080 USDT, repay all loans, keep ~578,295 USDT.
**How found:** Reading recycle() revealed it moves pair LULA via _basicTransfer + sync() with no USDT inflow, and that reward claims invoke it in a loop; also spotted _transfer() skips buyEnabled for fee-excluded addresses, enabling a swap output to the owner to bypass the buy gate.
**Exploitation:** Atomic tx: flash-loan ~197M USDT across 15 lenders, swap into LULA with output routed to the fee-excluded owner to bypass buyEnabled and inflate the pair's USDT reserve, then trigger reward claims that make Rental call recycle() repeatedly, pulling LULA out of the pair and sync()ing so the LULA reserve collapses while USDT stays. Sell 4,999 LULA back at the skewed price to extract ~197.6M USDT, repay loans, net ~578K USDT.
**Escalation:** Pre-positioned reward-accruing helper contracts 12 days early to control when recycle() drains fire; scaled the price skew with a ~$237M flash loan across 15 sources.
**Insight:** When a privileged function moves tokens out of an AMM pair via raw balance transfer + sync() without paying the other side, the pair reserve becomes attacker-controllable through any user-triggerable path (here reward claims). Also check whether transfer gates like buyEnabled are skipped for fee-excluded/owner addresses, since routing swap output there bypasses them.