What happened
Bankroll Network's buyFor function allowed the contract to be named as its own customer. Repeated self-purchases inflated dividends without adding WBNB to the pool, allowing the attacker to withdraw assets belonging to depositors.
Technical root cause
buyFor did not reject the contract itself as the customer. The self-transfer left its WBNB balance unchanged while dividend accounting credited a purchase fee, creating claims against existing pool funds.
How it happened
- The attacker acquired pool tokens to receive dividends.
- Calls to buyFor named the Bankroll contract as the customer, causing WBNB to transfer from the contract to itself.
- Each self-purchase still increased profitPerShare_, despite no new funds entering the pool.
- The attacker withdrew dividends inflated by these fictitious purchases.
Protocol details
Classification
Yield Aggregator / Input Validation
Protocol Type
Exploit/Flash Loan Attack
Implementation language
Solidity
Protocol links
Website
@Bankroll_Status
Evidence
- report Report cointelegraph.com
- report @TenArmorAlert incident report x.com
- analysis DeFiLlama defillama.com
- analysis Bankroll Network Hack Analysis blog.solidityscan.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
