Leaderboard
741All-time rank
L
LULA
Jul 28, 2026
$578K
Lost
$578K
Recovered
$0
Net loss
$578K
Unrecovered0% recovered
On July 29, 2026, LULA (BEP-20 token on BSC) suffered a ~$578K exploit via business logic flaw. Attacker exploited an accessible recycle() function in the Rental contract to transfer LULA directly from PancakeSwap V2 pair, then manipulated pair reserves via sync() call.
Repeated recycle() calls drained LULA reserves to near-zero, allowing small swap for nearly all USDT.
How the exploit worked
View reproducible PoCrecycle(), which moves up to a third of the pair's LULA to Rental and sync()s with no USDT leaving, so after a buy routed to the fee-excluded owner bypasses buyEnabled, the claims drain the pair's LULA reserve and 4,999 LULA buys back the pushed USDT plus the pool's liquidity.
Lost: ~578.3K USDT
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Jul 28, 2026Exploit executed — $578K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)