Flurry Finance Hack

Reported loss $293K
BNB Chain
Other

What happened

On 22 February 2022 an attacker drained about $293K from Flurry Finance's rhoToken vaults on BNB Chain. Flurry's FinanceRabbit strategy lent vault funds to Rabbit Finance's Bank contract, and the vaults' rhoToken multiplier was computed from that balance. The attacker forced a rebase while a Rabbit flash loan had temporarily emptied the Bank, which recorded an artificially low multiplier, then deposited cheaply and withdrew after the multiplier recovered.

Flurry paused all rhoToken contracts on BNB Chain and Polygon, stopped FLURRY rebasing and said only the FinanceRabbit strategy was hit.

How it happened

  1. The attacker took a flash loan from Rabbit Finance's Bank contract, the same pool where Flurry's FinanceRabbit strategy kept its funds.
  2. During the loan the attacker called Rabbit's StrategyLiquidate.execute(), which decodes caller-supplied data as an LP token address. The attacker passed a malicious token contract, so its code ran inside the loan.
  3. That malicious contract called FlurryRebaseUpkeep.performUpkeep(), which rebased every Flurry vault and recomputed rhoToken multipliers from strategy balances. Because the borrowed funds had not yet been returned, the Bank balance and therefore the multiplier were understated.
  4. After repaying the flash loan, the attacker deposited into the vault at the depressed multiplier, let the multiplier update back up, and withdrew more than was deposited. The cycle was repeated to extract roughly $293K.

Protocol details

Classification Yield Aggregator / Token & Share Accounting
Protocol Type Exploit/Other
Affected asset / contract FLURRY
Implementation language Solidity
Protocol links Website @FlurryFi

Evidence

Same attack technique

Browse all hacks →
BNB Chain BCE Token $679K lost Ethereum Pawnfi $820K lost BNB Chain BEVO NFT $45K lost Algorand Tinyman $3.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes