What happened
On September 10, 2024, Caterpillar Coin ($CUT) was exploited on BNB Smart Chain through a flash-loan-assisted manipulation of its PancakeSwap stablecoin/CUT pool. The attacker abused the token's external price-protection and liquidity-order logic to receive additional CUT during liquidity removal, then sold the inflated balance back into the pool. CertiK estimated the loss at approximately $1.4 million and reported about 99% slippage.
How it happened
- The attacker flash-borrowed about 4.5 million stablecoin units and used the funds to buy CUT, sharply moving the pool price.
- They added liquidity, which created an order/reward record using the manipulated price; only a fraction of the requested CUT was actually deposited.
- They sold the remaining CUT, moving the price back down.
- When they burned the LP position, CUT's removal path used the stale/manipulated order data and credited substantially more CUT than the pool transfer represented.
- They sold the extra CUT for stablecoins, repeated the cycle, and repaid the flash loan after extracting the reported amount from the pool.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
