What happened
On December 14, 2024 an attacker used a flash loan to extract about 11,200 BSC-USD from JHY, a small BNB Chain token, by draining rewards from its LP dividend tracker. JHY charged a 3% tax on sells: 2% was burned and 1% was sent to a dividend tracker that paid JHY rewards to liquidity providers. In JHYToken._transfer, the token moved 1% of each sale into the tracker but then called distributeCAKEDividends with 100% of the sale amount (a missing .div(100)), so every sell credited 100 times more dividends than were actually deposited. The tracker also set each holder's reward share to their current LP-token balance on every buy or sell. This let the attacker, holding freshly minted LP tokens, make itself the dominant shareholder and claim the inflated rewards at once. TenArmor noted the attacker appeared to be targeting other tokens as well.
Attacker: 0x00000000dd0412366388639b1101544fff2dce8d
Attack contract: 0x802a389072c4310cf78a2e654fa50fac8bdc1a55
Attack tx: 0xb6a9055e3ce7f006391760fbbcc4e4bc8df8228dc47a8bb4ff657370ccc49256
How it happened
- The attacker flash-borrowed 25,000 BSC-USD from a PancakeSwap V3 pool.
- It swapped 20,000 BSC-USD for JHY, then added the remaining BSC-USD and most of its JHY as liquidity, receiving LP tokens that made it the largest share in the dividend tracker.
- It ran several
removeLiquidityand sell cycles. Each sell reset its dividend share to its LP balance and credited the tracker with 100 times the JHY actually deposited. The tracker'sprocess()then paid that inflated JHY out to the attacker. - It sold the accumulated JHY for BSC-USD, repaid the flash loan and fee, and kept about 11,200 BSC-USD.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
