What happened
On August 2, 2026, LOOPSDAO’s LpdFi protocol on BNB Chain was exploited through manipulated LPD pricing and an interest-accrual edge case. A public transaction replay reports roughly $573,000 in attacker net gain; broader loss estimates include protocol fees and differ by accounting method.
Lpd.price() used instantaneous reserves from a thin PancakeSwap LPD/USDC pair without TWAP, liquidity-floor, or deviation protections, while interest accrued by discrete issue-index difference rather than elapsed time.
How it happened
The attacker temporarily inflated the thin LPD/USDC pool price, registered an oversized nominal principal through buy(), then crossed a daily issue boundary one second later and called claimInterest() to withdraw protocol-owned Cake-LP.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
