SKYDAO’s taxed sell flow called its pool controller before the seller’s net tokens were credited to the PancakeSwap V2 pair. The controller sold the 35% tax, moved the gross sell amount from the pair to the dead address through controlburn(), and called pair.sync(), causing the pair to record an almost-zero SKYDAO reserve. When the original transfer subsequently credited the net SKYDAO to the pair without updating that recorded reserve, the attacker exploited the balance/reserve mismatch through pair.swap() to extract USDT liquidity