Carson Hack
Reported loss
$150K
Flash-loan-assisted AMM price manipulation
What happened
Carson on BNB Chain was exploited in a flash-loan-assisted AMM price-manipulation attack. The attacker used temporary BUSDT liquidity to distort a Carson/BUSDT pool, then repeatedly swapped through a non-standard fee-on-transfer-compatible route to extract value before repaying the flash loans.
Technical root cause
A custom, closed-source AMM setup handled the Carson fee-on-transfer token unsafely. Its swap and reserve accounting could be driven into an attacker-favorable price imbalance; flash liquidity made the manipulation large enough to drain the pool.
How it happened
- The attacker nested flash loans from five DODO pools, used 1.5 million BUSDT to buy Carson and severely skew the Carson/BUSDT pool, then made 50 repeated Carson-to-BUSDT swaps plus a final sell.
- The flash loans were repaid in the same transaction; the profit came from the compromised pool's accounting and pricing behavior, not from DODO.
Protocol details
Classification
Oracle Manipulation / AMM Reserve Accounting
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
Carson
Implementation language
Solidity
Attacker Address
0x25bcbbb92c2ae9d0c6f4db814e46fd5c632e2bd3
Exploit Transaction
0x37d921a6bb0ecdd8f1…eb9662a3ac
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
