What happened
On June 17, 2023, Midas Capital's permissionless Ankr/Helio isolated pool on BNB Chain was exploited through a redemption-rounding flaw. Midas's post-mortem describes $340,000 drained from that pool, while Rekt reported a $600,000 loss; the sources do not reconcile the different figures. Midas paused the protocol, contacted authorities, and offered a bounty for return of funds.
How it happened
- The attacker reduced the HAY/BUSD market's cToken supply to
1001 wei, then donated LP tokens to the market. - Flash-loaned collateral and borrowed assets were used to create additional HAY/BUSD LP tokens, which were also donated.
- A redemption fraction of
1.998 weiwas rounded down to1 wei, allowing an outsized LP-token withdrawal. - The attacker repeated the rounding path and used self-liquidation to seize and redeem the remaining LP tokens.
Protocol details
Classification
Protocol Logic / Borrowing and Lending / Token & Share Accounting
Protocol Type
Lending
Implementation language
Solidity
Protocol links
Website
@MidasCapitalxyz
Security review history
- Zellic View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
