What happened
Bogged Finance lost roughly $3–3.6 million after an attacker used flash swaps to exploit a mismatch in BOG's transfer-fee and staking-reward accounting. The attacker inflated BOG staking rewards through repeated self-transfers, sold the extra BOG, and repaid the flash funding.
How it happened
- The attacker used flash swaps to add liquidity and obtain BOG/LP positions.
- It deposited LP tokens into the BOG staking system.
- Repeated self-transfers exploited a fee-accounting mismatch that credited more staking profit than the transfer charged.
- The attacker sold the resulting BOG, repaid the flash funding, and extracted the proceeds.
Protocol details
Classification
Exchange (DEX) / Token & Share Accounting
Protocol Type
DEX
Affected asset / contract
BOG
Implementation language
Solidity
Protocol links
Website
@boggedfinance
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
