PancakeBunny

PancakeBunny suffers a flash loan attack for $40M+

May 19, 2021
Attack Types: 
Flash Loan Attack
Entity Types: 
DeFi ,Yield Aggregator
Target Entities: 
PancakeBunny

Summary # On May 19, 2021 PancakeBunny, a yield farming aggregator built on Binance Smart Chain, suffered a flash loan attack. Exploit was possible because of how the protocol uses PancakeSwap AMM for its asset price calculation. In bugs like this, flashloans are the go-to way to manipulate the price of AMM pools which affects the price oracle – Adrian Hetman Source The hacker exploited a vulnerability related to reward minting to mint 6,972,455 BUNNY tokens, after which the flash loan was paid back, dumping the huge number of newly minted BUNNY in the market caused the token’s price to plummet, the attacker ran off with 114k BNB and 697k BUNNY. ...