ATM exploit analysis

Pancake V2 burn redeems any LP held by the pair contract itself. After a victim added WBNB/ATM liquidity and then (mistakenly) transferred the resulting LP back into the pair, the LP sat in the pair as a token balance that anyone could call burn against. The bot only needed a flash to front the WBNB side, so it called burn, kept the WBNB and ATM that came out, paid most of the WBNB back to a builder fee, and walked away with the remainder.

The attacker at 0x0eb4075c87ccd23a7ae1e00d77b043e4e8cc5894 saw the victim LP transfer on BscScan and executed a single-tx burn.

DeFiHackLabs reports a total loss of about 1,603.99 WBNB. The drain is in 0x4e9f3dc3ce3c0a6aa19dae0f1384ff46e801b433b7e3bc4c780de486db6c950a on BscScan. The setup transfer that left the LP tokens inside the pair is in 0x5c27edc326e38641d8ce6093cd7f15ae5fca039f5fb988b7f10cb432e6e3a056.

What would have prevented it: the LP holder checks the recipient address before sending, on the user side. On the contract side, disallow burn against LP that the pair holds under its own balance - but no fix at the contract layer was needed because the vulnerability was a user error compounded by a public pair-side burn.