MooCakeCTX Hack

Reported loss $140K
BNB Chain
Flash Loan Attack

What happened

On November 6, 2022 (UTC), an attacker took about $140,000 from the MooCakeCTX vault on BNB Smart Chain, an auto-compounding vault that staked CAKE in a PancakeSwap pool earning CTK rewards. The vault did not settle pending rewards before accepting a new deposit. Using flash-loaned funds, the attacker made a large CAKE deposit, triggered a harvest that compounded the accrued rewards into the vault, and withdrew with a share of rewards earned before they joined.

QuillAudits reported $143,921; Fairyproof reported about $140,000.

How it happened

  1. The attacker bought CTK with a small amount of BNB and transferred it directly into the PancakeSwap SmartChef pool that pays the vault's CTK rewards.
  2. They flash-borrowed 400,000 BUSD from DODO, supplied it to Venus as collateral and borrowed 50,000 CAKE.
  3. They deposited all 50,000 CAKE into the vault with depositAll(). The vault did not harvest or settle pending rewards first, so the new shares were priced as if no rewards had accrued.
  4. They called harvest() on the strategy, which claimed the CTK rewards, converted them and reinvested them, raising the value of every share, including the attacker's large new stake.
  5. They called withdrawAll() to take out more CAKE than they deposited, repaid Venus and the DODO flash loan, and kept the surplus.

Protocol details

Classification Token / Other / Token & Share Accounting
Protocol Type Exploit/Flash Loan Attack
Affected asset / contract MooCakeCTX
Implementation language Solidity

Evidence

Understand the attack patterns

Compare incidents →
Flash Loan Attacks

Same attack technique

Browse all hacks →
BNB Chain LAXO Token $191K lost BNB Chain PGNLZ token $100K lost BNB Chain Vista Finance $29K lost Ethereum Balancer $524K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes