Banana Swap Hack

Reported loss $110K
Other

What happened

Banana Swap, a small DEX built for trading the DDC token on BNB Smart Chain, lost about $104,600-$110,105 in stablecoins on August 28, 2022. Security trackers call it the DDC exploit.

The DDC token contract exposed a handleDeductFee function that any caller could use. It did not validate the fee amount or the addresses involved, so an attacker could deduct almost the whole DDC balance of the Banana Swap liquidity pair. After a sync, the pool's DDC reserve was nearly zero and DDC became extremely expensive, so the attacker swapped about 23 DDC for the pool's stablecoin reserve.

**Block data**

  • Attacker: 0x5b69f9c6cbb4958008eae46072886e6b9524fdef
  • Attack contract: 0x8aec5edbf6dae51da47b12c596effb9076fd7abb
  • Affected pair: 0x4efdcaba42cc31cf5198ec99bdc025aff1e32bb0
  • Exploit tx: 0xd08cfb22d14bc4f2808970b5ce2557124ae3d7dc9fda756647a3427b8275f054

How it happened

  1. The attacker bought a small amount of DDC through the Banana Swap router (0.1 BNB routed via USDT in the public reproduction).
  2. It read the pair's DDC balance and called handleDeductFee with a fee amount equal to almost that balance, with the pair as the from address and its own address as the user argument.
  3. Because handleDeductFee checked neither the amount nor the addresses, almost all of the pair's DDC was deducted from its balance.
  4. The attacker called sync on the pair so the reserves matched the drained DDC balance, pushing the DDC price up by orders of magnitude.
  5. It sold about 23 DDC back to the pair for almost all of its stablecoin reserve.

Protocol details

Classification Exchange (DEX) / Token
Protocol Type Exploit/Other
Affected asset / contract DDC

Evidence

Same attack technique

Browse all hacks →
Omni Bridge $272K lost DarkPool $104K lost Stader.Near $165K lost GenomesDAO $43K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes