STOToken Sell-Hook Reserve Manipulation Drains the STO/WBNB Pancake Pair

1. Incident Overview TL;DR

At BSC block 82257843, transaction 0xf7f741bf17299050a6e068f0af6eabc22f6389301d18b3c610537d7cc4422e03 performs a two-leg route (WBNB -> STO, then STO -> WBNB) through Pancake Router and extracts value from pair 0xa4e56ac9aa21184a0f68e2963b51146a4f556495.

The root cause is in STOToken (0xc6941c6bffdc844073e2c7c22816216c3890cd65): during sell transfers to the pair, token code burns pair-held STO and calls sync() before finishing the seller transfer to the pair. That mid-swap reserve rewrite violates AMM reserve-accounting assumptions and enables outsized WBNB payout.

2. Key Background

Pair model: Pancake V2 pricing/invariant checks assume reserves are updated from canonical token-in/token-out flow.
Victim token behavior: STOToken::_update includes custom buy/sell logic and a pre-sell burn hook.
ACT framing: no privileged role is required; any unprivileged actor can route swaps against public liquidity if sell path is open.

The exploitable condition is not private-key or admin dependent. It is a deterministic side effect of token transfer logic interacting with AMM reserve snapshots.

3. Vulnerability Analysis & Root Cause Summary

The issue is an ATTACK-class logic flaw at the token/AMM integration boundary. In the sell branch, STOToken computes a sellAmount, then executes and before . This allows the pair to record an artificially low STO reserve during swap pricing. Router/pair logic then executes against the manipulated reserve state, paying an excessive WBNB amount. Immediately after, token transfer settlement restores STO balance while quote-side liquidity has already been extracted.

STOToken Sell-Hook Reserve Manipulation Drains the STO/WBNB Pancake Pair

USD Estimate Context

Token Loss Details

Exploit Transactions

Victim Addresses

Similar Incidents

STO Pending-Sell Burn Reserve Manipulation

UPS Sell Hook Drains Pancake Pair

SOF Sell-Hook Reserve Manipulation Drains PancakeSwap V2 USDT Liquidity

Root Cause Analysis

STOToken Sell-Hook Reserve Manipulation Drains the STO/WBNB Pancake Pair

1. Incident Overview TL;DR

2. Key Background

3. Vulnerability Analysis & Root Cause Summary

YB Pair Sell-Hook Drain

NGP Sell-Hook Reserve Drain

XDK Sell-Hook Reserve Theft on PancakePair

4. Detailed Root Cause Analysis

5. Adversary Flow Analysis

6. Impact & Losses

7. References