ERC-777/1155/721 hook without reentrancy guard
PancakeSwap's assessment for RD-F-015 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Core AMM does not explicitly integrate ERC-777 tokensReceived or ERC-721 onReceived callbacks. However, the 2025 BCE/USDT ($679K) and OCA/USDC ($422K) pool drains both involved fee-on-transfer token interactions with the AMM — the V3 lock() partially mitigates reentrancy but doesn't prevent reserve accounting distortion via fee-on-transfer. This is a class risk inherent to permissionless AMM pools with arbitrary ERC-20 support. Yellow because the risk is present at the pool level even though no ERC-777 specific reentrancy was exploited.
Sources #
- URLPancakeSwap BCE/USDT ExploitBCE/USDT exploit — fee-on-transfer token interactionretrieved 2026-04-29
Methodology #
Determine whether the protocol integrates token standards with callbacks (ERC-777 tokensReceived, ERC-1155 onReceived, ERC-721 onReceived) without reentrancy guards on the affected functions.
See the full factor methodology and distribution across all protocols →