Incident Overview
BiSwap, a DEX on Binance Smart Chain, was exploited, resulting in the loss of 865,000 $USD.
BiSwap is a DEX, running on BSC. The protocol was exploited via a parameter validation issue. In an intricate exploit, BiSwap's system failed to verify the validity of tokens and their pair parameters, which was taken advantage of by an attacker. By forging token0, token1, and a pair, the attacker was able to manipulate the migration function of the migration contract, leading to a loss of users' burned assets.
In the first step, using a valid pair and fake tokens, the attacker called the migration function and added the users' burned assets into the contract, subsequently adding two fake tokens to the LP pool. In the second step, using real tokens and a fake LP, they called the migration function again, adding the assets left in the contract to their own LP. As a result, users' assets were replaced with fake LP assets, while real LP assets were added to the attacker's LP.
The stolen funds of 865,000 $USD were transferred through TornadoCash.
Attacker Addresses:
https://bscscan.com/address/0xe3aeede5…df30f6
https://bscscan.com/address/0xA1E31B29…9B1976
Malicious Contracts:
https://bscscan.com/address/0x2a825a17…c9b833
https://bscscan.com/address/0x839b0afd…9c1dbf
Malicious Transaction Example:
https://bscscan.com/tx/0xa6cc4b18…7d7a6c
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to BiSwap, these are the critical security checks that could have prevented this incident (June 2023).
- Verify all logic paths related to Other / Improper Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next BiSwap
The BiSwap hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.