BnbLabubu OLPC/LABUBU Reserve-Mismatch Exploit

On June 20, 2026, the OLPC/LABUBU liquidity pool on PancakeSwap V2 (BNB Chain) — part of the BnbLabubu meme-token project — was drained of approximately $1.1 million when a deflationary-burn flaw in the OLPC token created a reserve mismatch that the attacker exploited to buy out the pool's LABUBU at a distorted price.

What happened

PancakeSwap V2 pairs price assets with a constant-product (x·y=k) formula against cached reserves that are only synced on swaps and mints. OLPC, however, was a deflationary token whose _update() logic burned tokens on transfer. Roughly 46 days before the attack, OLPC's owner had changed the token's decimalsValue parameter from 1 to an enormous number — a change that enabled outsized burns — before renouncing ownership. The attacker sent a small transfer into the pair that triggered the burn of about 51.9 million OLPC and 124,000 LABUBU from the pool to a dead address, while the pair's cached reserves stayed unchanged. The gap between the cached reserves and the pool's real balances created a severe pricing distortion, and the attacker bought up the remaining LABUBU at a steep discount, converting the loot into roughly 1,115,903 USDT.

Aftermath

The exploiter bridged the proceeds to Ethereum and deposited about 633 ETH into Tornado Cash, laundering the funds; none were recovered. PancakeSwap stated that its own smart contracts were not at fault and that the issue stemmed from the OLPC token's configuration, and said it was continuing to investigate.

Why it matters

The incident is another reminder that fee-on-transfer and deflationary tokens break the core AMM invariant: constant-product pools assume a token's balanceOf equals the cached reserves, and any token that silently burns or rebases its balance opens a reserve-mismatch attack — the same class that has repeatedly bitten BNB Chain pools since PancakeBunny. It also shows how a single attacker-friendly parameter set before ownership renouncement (DIP Token) can sit dormant for weeks before anyone weaponizes it, and how cheaply launderable meme-token liquidity remains a favored target.