Privileged Token Function Drains $578K From LULA Liquidity Pool

The LULA token on BNB Smart Chain suffered an exploit that drained approximately $578,000 from its liquidity pool, according to an alert published by blockchain security firm BlockSec Phalcon.

The incident centered on a privileged function called recycle(), which the project’s Rental contract could invoke. The function allowed the contract to transfer LULA tokens directly from the PancakeSwap V2 trading pair before calling sync().

That sequence proved critical. Automated market maker pools track stored reserves to calculate token prices. The sync() function updates those reserve figures using the tokens currently held by the pair contract. Consequently, removing LULA and synchronizing the pool created an artificial imbalance between LULA and USDT.

ALERT! The $LULA token on BSC was exploited for approximately $578K through a reserve manipulation involving its privileged recycle() function. The function allows the Rental contract to transfer $LULA directly out of the PancakeSwap V2 pair and then invoke function sync(),… pic.twitter.com/3tgW1VKcum

— BlockSec Phalcon (@Phalcon_xyz) July 29, 2026

The attacker first executed a large USDT-to-LULA trade, substantially increasing the amount of USDT held in the pool. They then called recycle() repeatedly, reducing the pool’s LULA balance without conducting ordinary swaps.

Each subsequent synchronization caused PancakeSwap’s reserve records to reflect the increasingly distorted balances. This manipulation pushed the pool into a state where a relatively small quantity of LULA could be exchanged for a disproportionate amount of USDT.

The attacker finally sold a small amount of LULA back into the manipulated pool and extracted most of its remaining stablecoin liquidity. The operation generated an estimated profit of $578,000.

The crypto incident highlights the risks created when privileged token functions can directly alter decentralized exchange balances. Traders should watch for further analysis, fund movements, and any response from the LULA team.