DCF Hack

On December 17, 2024, Decentralized Finance (DCF) suffered a hack that resulted in a loss of approximately $9,000.

The victim contract contains an exchange function that uses PancakeSwap’s v2 pair reserves to determine the DCF/BUSD exchange rate. The attacker first swapped nearly all of the DCF tokens in the victim contract for BUSD. They then performed a large trade on PancakeSwap, manipulating the DCF price to appear artificially low.

Finally, the attacker returned to the victim contract and exchanged a small amount of DCF tokens for a disproportionately large amount of BUSD. By repeatedly taking advantage of the contract’s reliance on the manipulated on-chain price, the attacker walked away with around $9,000 in total.