Bacon Protocol Hack

What happened

On March 5, 2022, Bacon Protocol's Ethereum lending contract was exploited for about 957,209 USDC, or roughly $959,123. An attacker flash-borrowed 6.36 million USDC, lent it into Bacon Protocol, obtained more bHOME than intended through a suspected reentrancy, redeemed the excess bHOME for USDC, repaid the loan, and retained the difference. Bacon Protocol said it patched the affected contract and planned a re-audit.

How it happened

1. The attacker flash-borrowed 6.36 million USDC from Uniswap.
2. The attacker lent USDC to Bacon Protocol and received bHOME.
3. A suspected reentrancy in lend() allowed more bHOME to be issued than intended.
4. The attacker redeemed bHOME for USDC, repaid the flash loan, and kept the remaining USDC.

Protocol details

Classification Other / Reentrancy

Protocol Type Exploit/Flash Loan Attack

Affected asset / contract bHOME

Implementation language Solidity

Protocol links Website @BaconProtocol

Funds Recovery

95.7%

Recovered

$957K

Net Loss

$43,000

Evidence

• report @BaconProtocol incident report twitter.com
• report @peckshield incident report twitter.com
• report @BlockSecTeam incident report twitter.com
• report Post-mortem mirror.xyz
• analysis DeFiLlama defillama.com
• analysis Bacon Protocol Incident Analysis certik.com
• analysis NFT mortgage lender Bacon Protocol is hacked for $1 million web3isgoinggreat.com

Understand the attack patterns

Compare incidents →

Flash Loan Attacks Reentrancy