DarkPool Hack

Reported loss $104K
Other

What happened

The Dark Pool (DPC) token on BNB Smart Chain was exploited on September 9, 2022 for about $103,755 (Beosin EagleEye's figure), drained from its PancakeSwap liquidity pool.

DPC's contract paid rewards to users who staked DPC LP tokens. Beosin traced the flaw to one line in getClaimQuota, ClaimQuota = ClaimQuota.add(oldClaimQuota[addr]), which carried the previously recorded reward into each new reward calculation. As a result, the claimable reward kept accumulating when the attacker called claimStakeLp again and again. The attacker withdrew the inflated DPC and sold it for USDT. Beosin reported that the funds stayed in the attacker's address after the attack.

**Block data**

  • Attacker: 0xf211fa86cbc60d693d687075b03dff3c225b25c9
  • Attack contract: 0x2109bbecb0a563e204985524dd3db2f6254ab419
  • Draining tx: 0x92cab23d536d2e13ecb7c473350121165de0ae6c6c81be94ba502ac7db72e86f
  • Liquidity pool: 0x79cd24ed4524373af6e047556018b1440cf04be3

How it happened

  1. The attacker called DPC's tokenAirdrop so its contract qualified for rewards.
  2. It swapped USDT for DPC, added DPC/USDT liquidity on PancakeSwap and staked the LP tokens with stakeLp.
  3. It called claimStakeLp repeatedly. Because getClaimQuota added the stored reward (oldClaimQuota) into each new calculation, the recorded reward kept growing with each call.
  4. It withdrew the inflated reward as DPC through claimDpcAirdrop.
  5. It sold the DPC for USDT in the pool, taking about $103,755.

Protocol details

Classification Token
Protocol Type Exploit/Other
Affected asset / contract DPC

Evidence

Same attack technique

Browse all hacks →
Boy X Highspeed $2.6M lost Omni Bridge $272K lost Banana Swap $110K lost Stader.Near $165K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes