# Reserve desync via transfer or skim

Pair balance changed without swap accounting, leaving reserves stale and priceable against wrong backing

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-06-16. Updated 2026-11-02._

## How it works
A Uniswap-V2-style pair prices swaps from stored reserves, but those reserves are only cached copies of `balanceOf(pair)`. Any path that changes the pair's token balance without going through swap accounting — a direct transfer, a `skim()`, a token function that credits the pair — leaves reserves and real balances out of step. The next swap prices against the stale reserve, so the attacker trades at a rate the pool never intended. The broken assumption: that the only way a pair's balance moves is a swap that also updates reserves.

## Where it shows up
- Tokens with a sell/transfer fee, reflection, or rebasing logic paired on a V2 pool [E1](https://bugbountylibrary.com/r/dhl%3A20260616-dip.md)[E2](https://bugbountylibrary.com/r/dhl%3A20230206-fdp.md)[E3](https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md)
- Token functions callable externally that credit an address's balance, especially `deliver()`-style reflection hooks [E2](https://bugbountylibrary.com/r/dhl%3A20230206-fdp.md)
- Routers or token code that transfer the same amount twice, or transfer then `sync`/`skim` [E1](https://bugbountylibrary.com/r/dhl%3A20260616-dip.md)
- Pools where `getReserves()` is trusted for pricing but nothing forces it to match `balanceOf` [E1](https://bugbountylibrary.com/r/dhl%3A20260616-dip.md)[E3](https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md)
- Public `skim()` reachable after any balance change [E1](https://bugbountylibrary.com/r/dhl%3A20260616-dip.md)[E3](https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md)

## How to review
Trace every way the pair's token balance can change and confirm each one either goes through swap accounting or is harmless. The invariant: after any external call, `reserve0/reserve1` must equal the pair's actual token balances, or the gap must be unreachable by an attacker who can then swap. Check:
- Does the token's transfer/fee/reflection path credit the pair without a swap? [E2](https://bugbountylibrary.com/r/dhl%3A20230206-fdp.md)
- Can a direct transfer plus `skim()`/`sync()` shift reserves in the attacker's favor? [E1](https://bugbountylibrary.com/r/dhl%3A20260616-dip.md)[E3](https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md)
- Does the router or token double-transfer, and does that interact with a fee? [E1](https://bugbountylibrary.com/r/dhl%3A20260616-dip.md)
- Is pricing based on `balanceOf` rather than internal accounting, and can that be inflated? [E3](https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md)

## How finders spotted it
- Suspected the reflection token's `deliver()` could be called externally to inflate the pair balance without a sync, then swapped against [E2](https://bugbountylibrary.com/r/dhl%3A20230206-fdp.md).

## Variants seen
- Sell-fee token plus double router-transfer, then `skim`/`sync` to distort the paired reserve [E1](https://bugbountylibrary.com/r/dhl%3A20260616-dip.md)
- External reflection `deliver()` inflating pair balance, swapped for the other asset [E2](https://bugbountylibrary.com/r/dhl%3A20230206-fdp.md)
- Direct transfer of the token plus repeated `skim()` to desync price from real backing [E3](https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md)

## Impact and severity
Each case extracted most of the paired asset: 111k USDC profit [E1](https://bugbountylibrary.com/r/dhl%3A20260616-dip.md), nearly all WBNB [E2](https://bugbountylibrary.com/r/dhl%3A20230206-fdp.md), ~1.4 ETH [E3](https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md). Impact scales with pool depth and how far reserves can be pushed from backing; flash loans supplied the capital to amplify the swap [E2](https://bugbountylibrary.com/r/dhl%3A20230206-fdp.md)[E3](https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260616-dip.md
- E2: https://bugbountylibrary.com/r/dhl%3A20230206-fdp.md
- E3: https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth.md