Burned LP receipts failed to prevent $14.35M 79AU drain

A 79AU pool on PancakeSwap lost $14.35 million in USDT on Oct. 7. Blockchain data analysis traced the withdrawals to two selling wallets.

The analysis found that 79% of the pool’s liquidity-provider receipts, or LP receipts, had been sent to inaccessible addresses. Those receipts represent providers’ shares of a liquidity pool and allow holders to withdraw both assets in a trading pair.

A separate permission in the 79AU token contract allowed authorized addresses to pull 79AU from the pool. The tokens were then sold in the pool for USDT. The transactions used the token permission rather than LP receipts, so burning the receipts did not stop the withdrawals.

LP receipts govern liquidity redemption. Sending them to an inaccessible address prevents the holder from using them to withdraw assets. It does not stop trades involving the tokens already held by the pool.

PancakeSwap’s pair contracts use separate operations for liquidity redemption, swaps and reserve updates. The swap operation checks the tokens entering and leaving the pool without using LP receipts. The reserve-update operation reads balances from the token contracts.

A snapshot taken at 12:53 UTC on Oct. 8 identified two addresses with permission to pull 79AU: the token deployer and a newly authorized wallet. Read-only simulations indicated that either address could remove about 95% of the pool’s remaining 79AU. The simulations did not transfer funds.

The same snapshot showed that one wallet held the unburned 21% of the LP receipts. That holding provided ordinary redemption rights over its share of the pool.

A new check of the token’s transfer permissions is required to determine whether the addresses still have the ability to pull 79AU.