CS Hack

On May 23, 2023, an attacker drained the PancakeSwap pool of the newly launched CS token on BNB Smart Chain in one flash-loan transaction. Reported losses range from nearly $700,000 (Web3 Is Going Great) to about $710,000 (Beosin). The bug was in the token's own transfer logic, not in PancakeSwap.

CS stored the size of the last sale in a global sellAmount variable and used it to compute a burn amount. The variable was out of date when later transfers read it, so a transfer could trigger a burn sized from an earlier sale. By selling CS and then sending a tiny amount of CS to itself again and again, the attacker set off these stale burns, cut the pool's CS balance and pushed the CS price up against BSC-USD.

The attacker borrowed 80,000,000 BSC-USD, bought CS in 99 small swaps, sold it back into the manipulated pool, repaid 80,240,000 BSC-USD including the 240,000 fee, and kept the difference. Web3 Is Going Great reports the profit was converted to about 383 ETH and sent through Tornado Cash.

Exploit transaction: 0x906394b2ee093720955a7d55bff1666f6cf6239e46bea8af99d6352b9687baa4