OLPC exploit analysis

OLPC set decimalsValue to 7,326,680,472,586,200,649 (a value with the 18th decimal near 2^63) at BSC block 96,479,712, on May 5 2026 at 08:19:47 UTC. The token's transfer hook rebalanced pair reserves, and the decimals offset shrank the OLPC/LABUBU Pancake V2 pair reserve through a sync/skim cycle. After repeated cycles a Pancake supporting-fee swap with amountIn = 0 read the inflated OLPC pair balance as input, releasing LABUBU tokens that were then routed through WBNB into USDT.

The attacker at 0x18d6c39ae9e537f948aa2212d44d8c23944fc188 staged OLPC/LABUBU pair reserves through sync/skim cycles, then triggered the supporting-fee amountIn = 0 swap, draining the LABUBU side, swapping to WBNB and then to USDT.

DeFiHackLabs reports a total loss of about 1,115,903.66 USDT. The drain is in 0x8dabb60a94e5124462e5f494a25c14bcd52f6f4d1f7c665a249496f4c6c24764 on BscScan. The setup tx that set decimalsValue is in 0xa413fdf688398348ddf0246275c6fe3a98806670252e44bfe0acd50b4d50efa2.

What would have prevented it: rejecting decimalsValue outside a small sanity range, or a transfer hook that doesn't use decimalsValue to scale pair reserves at all.