Dot Finance Hack

TOTAL LOST $430K
Low Oracle Manipulation & Price Manipulation bsc

What happened

Team announcement:

"Someone took advantage of an opening that was set in our contracts in preparation for a future PINK farm on PancakeSwap.

The user deposited CAKE tokens and made the system believe the farm existed. The deposited tokens was mistaken by the vault as yield which was rewarded back to him as PINK tokens when he withdraw his funds.

By the time we disabled all of our contracts, this person had managed to withdraw tokens, which he later on sold on the market.

Dot Finance Team identified the configuration exploit and enabled our contracts for complete operational form.

There was no need to upload new contracts as there was no breach in contracts.

There was no need to examine the protocol as there was no exploit in our protocol.

We suffered from an exploit in configuration, which is now closed.

These days, our contract is going through a new audit, and we are working on shifting to the Kusma network (an update on that will be published soon).

Dot Finance team knows and understands that these kinds of events can cause stress and uncertainty. We want to emphasize our responsibility for every token deposited on our system and doing our 100% to keep our community funding safe, which we did and will keep doing in the future.

Thank you for the support and understanding and for going back with full force towards our future destination."

Case & protocol details

Classification Yield Aggregator / Oracle Manipulation
Protocol Type Exploit/Other
Affected asset / contract PINK
Smart Contract Language Solidity
Official Website dot.finance/
Protocol Twitter/X @dot_finance

Evidence & learning

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.