What happened
Bearn DAO's strategy contract converted a large token balance through a swap with no minimum output. An attacker manipulated the ALPACA/WBNB pool, triggered that conversion at the unfavorable rate, and reversed the manipulation to extract value.
Technical root cause
convertDustToEarned treated the strategy's full token balance as dust and swapped it without a minimum-output safeguard. A caller could sandwich that conversion between price-moving trades.
How it happened
- Funds remained in the strategy contract following an emergency withdrawal.
- The attacker distorted the ALPACA/WBNB exchange ratio through large swaps.
- The attacker called convertDustToEarned, causing the strategy to swap its entire relevant token balance with a zero minimum output.
- A reverse swap captured the value lost by the strategy's conversion.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
