🚨 $FOX just got drained for $118.7K via a classic AMM manipulation exploit
Here's the alpha on how it went down:
The FoxLpBondsPool.stake() function calculated _stakeAmount using a manipulable PancakeSwap spot price BEFORE executing a massive USDT→$FOX swap. That swap moved the reserves hard, but the contract never recalculated the stake amount based on actual LP tokens received.
Treasury.lpBonds() blindly trusted this stale number, minted fresh $FOX, and instantly sent inviterRewardAmount to the attacker's referral address. Attacker dumped the newly minted $FOX back into the pair—same transaction. Flash loan scaled it up.
Core issue: No manipulation-resistant oracle, no accounting validation, no vesting on rewards.
Attacker: 0x3a82...d2da
Victim Pair: 0xaab1...8803 (USDT/$FOX)
Vulnerable contracts: FoxLpBondsPool (0x58e2...655a) | Treasury (0x8761...04d)
Another day, another AMM exploit. If your protocol calculates value from spot price mid-transaction, you're exit liquidity.
Here's the alpha on how it went down:
The FoxLpBondsPool.stake() function calculated _stakeAmount using a manipulable PancakeSwap spot price BEFORE executing a massive USDT→$FOX swap. That swap moved the reserves hard, but the contract never recalculated the stake amount based on actual LP tokens received.
Treasury.lpBonds() blindly trusted this stale number, minted fresh $FOX, and instantly sent inviterRewardAmount to the attacker's referral address. Attacker dumped the newly minted $FOX back into the pair—same transaction. Flash loan scaled it up.
Core issue: No manipulation-resistant oracle, no accounting validation, no vesting on rewards.
Attacker: 0x3a82...d2da
Victim Pair: 0xaab1...8803 (USDT/$FOX)
Vulnerable contracts: FoxLpBondsPool (0x58e2...655a) | Treasury (0x8761...04d)
Another day, another AMM exploit. If your protocol calculates value from spot price mid-transaction, you're exit liquidity.