ORB exploit analysis

ORB on BNB Chain was drained of ~44.9-45 BNB on 2026-09-11, around $32,610, when the attacker re-entered ORBCore.addPoolAndSell() through its refund-before-sell path after staging the attack through Venus and Moolah flash loans (attack transaction, block 121296110). DeFiHackLabs reconstructs the drain against the verified ORBCore source and the full on-chain trace.

ORBCore.addPoolAndSell()'s sell branch refunds the BNB to the caller via safeTransferETH(account, BNBValue) BEFORE _sellToken() runs, and _sellToken() itself refunds userBNB to the caller BEFORE its final burnLP(). Both refunds run with no reentrancy guard. The attacker's receive()/fallback re-enters at each refund and exits with the freshly-pool-reserved liquidity that should have backed the next user's withdraw.

The leverage stage amplified the drain: the attacker borrowed BNB from Venus, swapped it for ORB, and borrowed more from Moolah, walking the burnLP reserve down before the final reentrancy ran.

The fix is a nonReentrant guard on both refund paths, and an accounting check that the user's BNB refund equals the BNB the contract actually received from the pair.