What happened
On November 24, 2024, an attacker drained more than $428,000 from a USDT-DCT liquidity pool on BNB Smart Chain by abusing the transfer logic of the linked DCF token. The DCF contract enforced a "forced investment" rule: when DCF was sent to the USDT-DCF pool address, 5% of the tokens were automatically converted to USDT and added to the USDT-DCT pool. That triggered a PancakeSwap swap in the USDT-DCT pool that any sender could set off on demand, letting the attacker move the DCT price and profit.
A burn in the DCF contract also removed almost all DCF from the pair, which made the damage worse.
- Attacker:
0x00c58434f247dfdca49b9ee82f3013bac96f60ff - Vulnerable DCF contract:
0xa7e92345ddf541aa5cf60fee2a0e721c50ca1adb - Exploit transaction:
0xb375932951c271606360b6bf4287d080c5601f4f59452b0484ea6c856defd6fd
How it happened
- The attacker borrowed a large amount of USDT.
- They used it to buy DCF and DCT.
- They transferred DCF to the PancakeSwap pool address. The DCF transfer hook converted 5% of the amount into USDT and added it to the USDT-DCT pool, moving the DCT price in the attacker's favour.
- A burn in the DCF contract drained nearly all DCF from the pair, adding to the price distortion.
- The attacker swapped the now-overvalued DCT back to USDT, taking more than $428,000.
Protocol details
Evidence
- report BlockSec Phalcon alert on the DCT/DCF attack (via fxtwitter API) x.com
- report @0xNickLFranklin incident report x.com
- transaction Blockscan transaction 0xb3759329...d6fd blockscan.com
- transaction bscscan.com transaction 0xb375…d6fd bscscan.com
- analysis How Wrong Transfer Logic Led to DCF Token Hack quillaudits.com
- analysis DCF Token Hack Analysis blog.solidityscan.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
