SlowMist’s Cosine Questions the LABUBU “Theft” Incident on BNB Chain: Key Parameters Appear to Have Been Abnormally Modified

According to Odaily, SlowMist founder Cosine analyzed that there are suspicious aspects to the approximately $1.1 million capital loss incident that occurred in the OLPC / LABUBU liquidity pool on BNB Chain. The theft was caused by a severe imbalance in the OLPC/LABUBU trading pair, and the reason for the imbalance was an "exploit" in OLPC that was taken advantage of. In the _update function, under certain conditions, it was possible to burn OLPC in the amount of value * decimalsValue. Normally, decimalsValue is 1, but about 46 days before the attack, the owner changed it to an extremely large value: 7326680472586200649. A few days later, the OLPC owner renounced ownership, making the owner address the zero address.

Today, the attacker took advantage of this excessive decimalsValue to trigger a Pair reserve burn, allowing them to obtain a large amount of LABUBU with a small amount of OLPC. The attacker ultimately exchanged 1.115 million USDT at a low cost. The suspicious point lies in the setting of decimalsValue—why would the OLPC owner set it to such a massive value?