What happened
On August 15, 2026, Fox Market on BNB Chain was exploited through an atomic flash-loan attack. The attacker over-minted protocol bonds using a stale spot quote and drained roughly $678K of pool liquidity; independent analysis estimates approximately $119K–$120K in net attacker profit after fees.
Technical root cause
The bond-mint path sampled a live AMM spot price before executing its own large pool-moving swap and did not re-check the deposited value or resulting price before minting. This stale pre-swap snapshot let the same transaction obtain materially inflated FOX issuance.
How it happened
- The attacker used flash liquidity to move the FOX/USDT pool, then FoxLpBondsPool.stake() calculated issuance from the pre-swap spot price instead of the post-swap state.
- The resulting over-minted FOX and referral reward were sold back into the pool before the flash loans were repaid.
Protocol details
Classification
Oracle Manipulation
Protocol Type
Exploit/Flash Loan Attack
Implementation language
Solidity
Evidence
- report @ShiroCipher incident report x.com
- report @TenArmorAlert incident report x.com
- analysis DeFiLlama defillama.com
- analysis Smart Contract Hacking: Fox Hack 2026 smartcontractshacking.com
- analysis SigIntZero: FoxMarket $119K exploit sigintzero.com
- analysis CoinKyt: FoxMarket stale-price exploit coinkyt.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
