🚨SlowMist TI Alert🚨 💸 $ORB Loss: ~ $32,610.72 🔍 Root Cause: The ORBCore contract acts as a whitelisted entity for ORBToken, allowing ORB to be sold without incurring the 5% burn tax. Attackers exploited a mechanism where the ORBToken contract's `receive()` function automatically grants a maximum allowance and triggers an external call to the ORBCore contract's `addPoolAndSell` function(which lacked a reentrancy guard), thereby enabling a cycle of tax-free sell-offs. Furthermore, when the ORBCore contract sells tokens, it uses the `burnLP` function to destroy a large amount of ORB within the liquidity pool (Pair); finally, the attackers call `sync()` to manipulate reserve balances and profit. 📌 Attacker (EOA): 0xd8b49172b1a33e77c2619a78e08471facff5dad3 📌 Attack Contract: 0x4f33733a40fae6c19c3a4faf9bc08ce9a1806831 📌 Vulnerable Contracts: ORBToken: 0xc4d27261c06407053cad16cb825ecc0eee7ee7d7 Core: 0x24b6308ab84b182d0598b73d21a42f4c2bb33c18 PancakeSwap Pair: 0x64fad72e5dde70b2960497744b348fd64cb4788c Tx: Powered by