Kaoya Swap Hack

KaoyaSwap, a DEX on BNB Smart Chain, was exploited on August 24, 2022. The attacker profited about 37,294 BUSD and 271.2 WBNB, roughly $118,000.

Unlike Uniswap V2, where each pair contract holds its own reserves, KaoyaSwap's router held the tokens for all pools. Its swapExactTokensForETHSupportingFeeOnTransferTokens function paid the user the drop in the last pair's WBNB balance, measured before and after the whole swap. That works when the last pair appears once in the path. If the path passes through the last pair twice, the measured difference no longer matches what the final hop actually produced, and the router pays out WBNB that belongs to other pools.

The attacker used a flash loan of 1,800 WBNB and two self-made tokens to route a swap through the same TokenA/WBNB pair twice. KaoyaSwap did not publish an official statement at the time.

**Block data**

• Exploit tx: 0xc8db3b620656408a5004844703aa92d895eb3527da057153f0b09f0b58208d74
• Attack contract: 0xa722ca7bf032de8f7a675da75dfec661bc89ace9
• Vulnerable router: 0x879ead67c92ec2bfa70fa9d157f500b7b31b64ab