What happened
On June 21, 2023, an attacker drained about 442 BNB (roughly $100,000) through the BabyDoge Coin token on BNB Smart Chain. BabyDoge charges a fee on transfers and periodically sells its own accumulated tokens for BNB to add liquidity. A third-party contract had been excluded from those fees, so the attacker could move large BabyDoge amounts for free and sandwich the token's automatic liquidity sale, which had no effective slippage protection.
Hexagate said it had flagged the attack contract on June 12, nine days before it was used, and Cyvers reported the attacker was funded through Tornado Cash. CertiK, which audited BabyDoge in 2021, said the issue fell outside that audit's scope.
How it happened
- The attacker took a flash loan of USDT and BUSD from a PancakeSwap V3 pool, supplied it to Venus and borrowed BNB against it.
- Using a router contract that BabyDoge had excluded from its transfer fee, the attacker bought BabyDoge and moved tokens into the PancakeSwap BabyDoge/WBNB pair without paying the fee, selling them to push the BabyDoge price down.
- The attacker then topped up the token contract's own balance to its
numTokensSellToAddToLiquiditythreshold and made a transfer that triggered BabyDoge's automatic sell-and-add-liquidity routine, which dumped the contract's tokens into the depressed pool with no minimum-output check. - The attacker bought BabyDoge back cheaply, moved it fee-free to the pair on BabyDoge's own router and sold it there for WBNB.
- After repaying Venus and the flash loan, the attacker kept about 441-442 BNB.
Protocol details
Evidence
- report @CyversAlerts incident report twitter.com
- report Hexagate alert on the BabyDoge exploit (X post, Jun 21 2023 13:57 UTC) twitter.com
- report Cyvers alert on BabyDoge (X post, Jun 21 2023 13:03 UTC) twitter.com
- transaction bscscan.com transaction 0xbaf3…866c bscscan.com
- address bscscan.com address 0x9a6b…c98e bscscan.com
- address bscscan.com address 0xee67…a1d1 bscscan.com
- code DeFiHackLabs BabyDogeCoin02_exp.sol PoC github.com
- code DeFiHackLabs past/2023 README github.com
- analysis Web Archive archive.ph
- analysis Sneaky Sandwich Exploit: The BabyDoge Attack Caused 442 BNB Loss certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
