BabyDogeCoin Hack

Reported loss $135K
Flash Loan Attack

What happened

On May 28, 2023, an attacker took about 437 BNB (roughly $135K-$137K) from the Baby Doge Coin token system on BNB Smart Chain. Normal BabyDoge buys and sells pay a 10% tax, but the project's FarmZAP contract was exempt, and anyone could call it. The attacker used a flash loan and FarmZAP to trade between the BabyDogeSwap and PancakeSwap pools without paying tax.

They also triggered the token's swapAndLiquify sell to push down the price on PancakeSwap. PeckShield reported that the profit was sent to the FixedFloat exchange, which had also funded the attacker's wallet. The developers then removed FarmZAP's tax exemption.

How it happened

  1. The attacker flash-borrowed 80,000 WBNB from Radiant's lending pool.
  2. Through FarmZAP, which paid no BabyDoge tax, they bought BabyDoge from the BabyDogeSwap router's pair.
  3. They sold that BabyDoge from FarmZAP into the PancakeSwap pair for about 13,208 BNB.
  4. They transferred 1 BabyDoge out of the farm. This triggered the token's swapAndLiquify, which sold contract-held BabyDoge into the PancakeSwap pair and added liquidity, leaving BabyDoge cheaper on PancakeSwap than on the BabyDogeSwap pair.
  5. They bought BabyDoge on PancakeSwap with about 13,202 BNB and sold it tax-free into the BabyDogeSwap pair through FarmZAP. After repaying the flash loan and its fee, they kept about 437 BNB.

Protocol details

Classification Token
Protocol Type Exploit/Flash Loan Attack
Affected asset / contract BabyDoge
Protocol links Website @BabyDogeCoin

Evidence

Understand the attack patterns

Compare incidents →
Flash Loan Attacks

Same attack technique

Browse all hacks →
wDAO EON $29K lost ERC20 Token Bank $109K lost OceanLifeToken $11K lost ASKACR Token $29K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes