# ORB: refund-before-sell reentrancy drains burnLP-depleted pool

ORB token's unguarded refund-before-sell reentrancy in ORBCore.addPoolAndSell, amplified by Venus/Moolah leverage to buy out the pool, drains ~45 BNB.

- Payout: Real-world hack
- Severity: critical
- Program: ORB
- Disclosed: 2026-09-11
- Write-up quality: 9/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/ORB_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260911-orb
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:oracle-manipulation vuln:reentrancy

**Target:** BEP-20 token + ORBCore contract on BNB Chain (PancakeV2 pair, Venus, Moolah)
**Root cause:** ORBToken.receive() forwards BNB to ORBCore.addPoolAndSell(), whose sell branch refunds BNB to the caller before _sellToken() runs, and _sellToken() refunds userBNB before its final burnLP() - two unguarded re-entry points. ORBCore is whitelisted so its transfers skip burn tax, and burnLP() burns ORB directly from the pair reserve and calls sync().
**Steps:**
1. Flash-loan all WBNB (241,591) from Moolah, then nested flash-loan all BTCB (3,145) from Moolah.
2. Deposit BTCB into Venus VBTCB, enterMarkets, borrow 260,000 BNB from VBNB.
3. Wrap borrowed BNB to WBNB; keep ~10 BNB native for triggers.
4. Approve ORB to ORBCore; call ORBToken.receive() with `0.0009 BNB` to enter addPoolAndSell sell path.
5. Re-enter at the userBNB refund in _sellToken() recursively (depth up to 70), so swaps run on the way down and burnLP() runs on the way up against the emptied pool.
6. Big buy at deepest level pushes pair to ~448,325 WBNB / ~590 ORB; burnLP loop grinds ORB reserve to dust.
7. Final small ORB sell drains inflated WBNB side; repay Venus borrow, redeem BTCB, repay both Moolah flash loans.
8. Withdraw remaining WBNB to native and transfer ~44.9-45 BNB profit to owner.
**How found:** Source review of ORBCore.addPoolAndSell and _sellToken revealed refunds (safeTransferETH) occurring before state-changing sell/burnLP calls with no reentrancy guard, plus ORBCore's whitelist bypassing transfer tax and burnLP() burning directly from the pair reserve; on-chain trace confirmed the ordering and the need for leverage.
**Exploitation:** Attacker used Moolah 0% flash loans (WBNB + BTCB) and Venus collateralized borrowing to temporarily acquire ~500k BNB, bought out nearly all ORB from the PancakeV2 pair, then exploited the unguarded refund-before-sell reentrancy to recursively burn the pair's ORB reserve via burnLP() and finally sell a tiny ORB amount into the inflated WBNB reserve, netting the pool's real ~45 WBNB after repaying all loans.
**Escalation:** Leverage staging (nested flash loans + Venus borrow against flash-loaned BTCB) was required because the attacker's 3,483 ORB was far too small to deplete a 5.826M-ORB reserve; buying out the pool first made the reentrant burnLP loop viable.
**Insight:** When a contract refunds ETH/BNB to msg.sender before completing its swap+burn logic, the receive()/fallback is a re-entry point; check whether the contract is whitelisted on the token (skipping tax) and whether a burn function mutates the AMM pair reserve directly - then model whether a temporary leveraged buyout can shrink the reserve enough for the reentrant loop to matter.