What happened
On October 6, 2021, an attacker used a flash loan against My Farm Pet, a blockchain farming game on BNB Smart Chain, and profited about 31,410 BUSD. The game's Marketplace V2 and V3 both priced items from the amount of MyFarmPet token held in the PancakeSwap MyFarmPet/BUSD pair. The attacker bought ChickenFood on V2 at one pool state, then moved the pool and sold the ChickenFood on V3 for far more MyFarmPet.
The attacker ran the attack again right away for about 129 BUSD more. The BUSD was swapped to BNB and sent to Tornado Cash.
How it happened
- The attack contract flash-borrowed 340,000 BUSD from a PancakeSwap pool.
- It swapped the 340,000 BUSD for about 22,000 MyFarmPet on PancakeSwap.
- It spent 1,000 MyFarmPet to buy 70,000 ChickenFood on Marketplace V2.
- It swapped the remaining ~21,000 MyFarmPet back for about 337,000 BUSD. That raised the pair's MyFarmPet balance, which is what the marketplaces read as the price.
- It sold the 70,000 ChickenFood on Marketplace V3, which now paid out about 46,000 MyFarmPet.
- It swapped the 46,000 MyFarmPet for about 34,000 BUSD, repaid the 340,000 BUSD loan and kept about 31,410 BUSD.
- The profit was swapped to WBNB, withdrawn as BNB and deposited into Tornado Cash.
Protocol details
Classification
Gaming / Metaverse
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
MYFARMPET
Protocol links
Website
@Myfarmpet1
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
