PHX token's transfer-fee logic burned tokens from the pair before crediting post-fee amounts, causing recorded reserves to desynchronize with actual balances. An attacker used a flash loan to fund the manipulation, exploiting the mismatch to drain WBNB from the liquidity pool.