Here’s the exact attack flow I reconstructed:
1️⃣ Flashloan 11.76M USDT.
2️⃣ Buy MT on Pancake (swapExactTokensForTokensSupportingFeeOnTransferTokens) to force the MT token’s transactionFee() to overcharge the pair (AMM is a contract → fee branch).
3️⃣ Call skim() so the pair transfers MT out again → the same broken splitter drains MT balance down to ~0.034 MT.
4️⃣ Call sync() to lock in reserves (near-zero MT, huge USDT).
5️⃣ Swap a tiny MT amount into the pool → receive 226,722 USDT out.
6️⃣ Repay flashloan → keep 36,995 USDT profit.