DIP exploit analysis

DIP's token took a sell fee on transfers out of the registered DIP/AIC Pancake V2 pair. A double router-transfer bug meant a single external transferFrom could burn the same sell fee twice in one swap, shrinking the pair's DIP reserve below the actual DIP-held balance. After skim() + sync(), the pair was pinned at a deflated DIP reserve; the attacker then swapped the residual DIP for nearly all of the pair's AIC, repaid the AIC flash, and walked away with USDC.

The attacker at 0x0d4024cd27538350a911d9b7ee90811fa4875ba3 used the historical attack contract 0xddef10a85a5c67a9af8398d297aa51f8716383c7 (open source).

DeFiHackLabs reports a total loss of about 111,097.59 USDC. The drain is in 0x1c09395848a87069c9d6ddbe5adc6249510aba7a2a83479a74b4280cafb5fb29 on BscScan.

What would have prevented it: a transfer-hook sell-fee that only applies on transfers where the recipient is not a registered Pancake router, or a _transfer that idempotently tracks whether the sell fee has already been charged on a given transfer.