SKYDAO (BSC Swap Logic / Premature Sync Exploit, September 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
Summary
SKYDAO is a BSC-based token project whose SKYDAO/USDT PancakeSwap V2 liquidity pair was drained of approximately $183,483 on September 30, 2026 via a flash loan attack that exploited a premature sync() call in the token's sell-tax logic. The exploit has been reproduced in a public DeFiHackLabs proof-of-concept, and as of October 7, 2026, the SKYDAO team has not issued an official post-mortem or confirmed any patch.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(4 events)
30 September 2026
SKYDAO/USDT PancakeSwap V2 pair drained of 183,482.88 USDT via burn-from-pair + premature sync() exploit on BNB Chain (block 124,921,242). Attacker netted approximately 59,914.12 USDT after repaying 2,656,932.60 USDT Moolah flash loan.
DeFiHackLabs PR #1286 (on-chain PoC)2 October 2026
DeFiHackLabs PR #1286, adding a public Foundry proof-of-concept reproducing the SKYDAO exploit, merged into the SunWeb3Sec/DeFiHackLabs repository.
DeFiHackLabs PR #12865 October 2026
Third-party on-chain post-mortem for the SKYDAO/USDT pair drain published in RealSpap/onchain-postmortems repository (not an official SKYDAO team communication).
RealSpap/onchain-postmortems GitHub releases7 October 2026
As of this investigation date, no official post-mortem, patch confirmation, or public statement from the SKYDAO team has been identified. The @SkyDAO_Trust X account showed no exploit-related posts.
AVOID.NET investigation (search of public sources)Decision Log
- #1publishNot recorded (failed)10/7/2026, 1:22:24 PMhash 3yNgGRLU5xVZrTT5WLZpmBL3Qedfycx9REuuijpXMkEF
model: claude-sonnet-4-6
generated: 10/7/2026, 1:22:17 PM
last updated: 10/7/2026, 2:17:17 PM
avoid.net — verified advice for a post-truth world