# AMM reserve desync via token hooks

Token hooks, burns, mints or raw transfers that move pair balances without a matching swap or sync

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2026-07-28. Updated 2026-11-02._

## How it works
An AMM prices swaps from stored reserves, which should only change when a swap or liquidity event moves both sides fairly. This pattern breaks that: a token's transfer hook, burn, mint, reflection payout or privileged function moves tokens into or out of the pair via a raw balance transfer, burn or `sync()`, without the other asset moving. The pair's real balance and its reserves drift apart — either the reserve is shrunk with nothing paid in, or the pair's token balance is inflated without a matching reserve update. Whoever can trigger that function can then swap against the skewed reserve and take the difference.

## Where it shows up
- Token `_transfer`/`_basicTransfer` hooks that call `pair.sync()` or burn on transfers to the pair [E1](https://bugbountylibrary.com/r/dhl%3A20260728-lula.md)[E3](https://bugbountylibrary.com/r/dhl%3A20260428-judao.md)
- Privileged functions (reward claims, `recycle()`) that pull tokens from the pair via raw transfer and sync [E1](https://bugbountylibrary.com/r/dhl%3A20260728-lula.md)
- Helper contracts exposing `userMint`/`userBurn` against a live pair [E2](https://bugbountylibrary.com/r/dhl%3A20260606-boss.md)
- Burn logic that can inflate the pair's token balance independently of reserves [E4](https://bugbountylibrary.com/r/dhl%3A20260222-laxo-token.md)
- Transfer-tax accounting where the pair's received amount may not match the amount used for pricing [E2](https://bugbountylibrary.com/r/dhl%3A20260606-boss.md)

## How to review
For every path that changes a pair's token balance, ask: did the other side of the pair move by the fair amount, and were reserves updated to match? The invariant: between syncs, `reserve == balance` must hold, and the price implied by reserves must equal the price a swapper actually gets. Check that `sync()` is never called after a one-sided move, that burns/mints cannot target the pair, and that tax taken on transfer is reflected in the reserve used for pricing. Confirm privileged functions that move pair tokens are not user-triggerable in a loop.

## How finders spotted it
- Read `recycle()` and saw it moved pair LULA via `_basicTransfer` plus `sync()` with no USDT inflow, and that reward claims call it repeatedly [E1](https://bugbountylibrary.com/r/dhl%3A20260728-lula.md)
- Reviewed the sell transfer hook and suspected that sending tokens to the pair triggers `sync` and burn, changing reserves without a swap [E3](https://bugbountylibrary.com/r/dhl%3A20260428-judao.md)

## Variants seen
- Privileged reward-claim path draining reserve via raw transfer + sync [E1](https://bugbountylibrary.com/r/dhl%3A20260728-lula.md)
- Helper mint/burn plus tax accounting skewing the pair [E2](https://bugbountylibrary.com/r/dhl%3A20260606-boss.md)
- Sell hook burning pair reserves and syncing [E3](https://bugbountylibrary.com/r/dhl%3A20260428-judao.md)
- Incorrect burn logic inflating the pair's token balance before a swap [E4](https://bugbountylibrary.com/r/dhl%3A20260222-laxo-token.md)

## Impact and severity
Losses ranged from ~137K US$ [E4](https://bugbountylibrary.com/r/dhl%3A20260222-laxo-token.md) and 10,207 USDT [E2](https://bugbountylibrary.com/r/dhl%3A20260606-boss.md) to ~578K USDT [E1](https://bugbountylibrary.com/r/dhl%3A20260728-lula.md). Impact rose with flash-loan funding to scale the skew [E1](https://bugbountylibrary.com/r/dhl%3A20260728-lula.md) and pre-positioned reward-accruing contracts to time the drain [E1](https://bugbountylibrary.com/r/dhl%3A20260728-lula.md). A separate `buyEnabled` bypass on fee-excluded addresses [E1](https://bugbountylibrary.com/r/dhl%3A20260728-lula.md) is a distinct gate weakness, not part of this root cause.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260728-lula.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260606-boss.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260428-judao.md
- E4: https://bugbountylibrary.com/r/dhl%3A20260222-laxo-token.md