ASKACR Token Hack

On March 21, 2023, the ASKACR token on BNB Smart Chain was exploited through its reward logic. The attacker's profit was about 28,633 BSC-USD (USDT). CertiK put it at about $28K, and BlockSec reported a loss of about 85 BNB. CertiK reported the token's price dropped 98%, and Neptune Mutual later said it fell more than 99%.

According to BlockSec, ASKACR's transfer function paid rewards to holders of BSC-USD/ASKACR LP tokens on every transfer without checking the transfer amount. Neptune Mutual traces this through _beforeTokenTransfer into _lpShare. So a transfer of 0 ASKACR to an address holding LP tokens still paid that address a reward share. The attacker used one flash-loan-funded LP position and passed it through many freshly created contracts, collecting a new reward at each stop.

The live record says the flash loan came from Balancer and that the profit came from buying low and selling high. The transaction shows otherwise: the 160,000 BSC-USD loan came from pool 0x26d0...5618, and the profit came from the reward payouts.

Attacker: 0xb1899430b21f646b1b298a3f0c0707ea4047c53e

Attack contract: 0x559a352d205d5df7cd8021891ab9c680f7f278e2

Exploit transaction: 0xc20fa4953ff394bb806a57cafe71d1163973c0e5a47bb8dad1703a518b15ea3b