What happened
On April 19, 2023, Ocean Life (OLIFE) on BNB Smart Chain was exploited through a reflection-token accounting flaw. The attacker used a flash loan and PancakeSwap trades to distort the token's supply/price accounting, drained WBNB from the pool, repaid the loan, and retained 32 WBNB as reported profit.
How it happened
- The attacker borrowed 969 WBNB from DPPOracle and exchanged it for OLIFE through PancakeSwap.
- During the token transfer path, the contract internally invoked
_reflectFee, reducing_tTotal. - The resulting accounting mismatch made the pool's
balanceOf()value exceed the amount represented by its reserves. - The attacker called the pool swap path to withdraw WBNB, repaid the 969 WBNB flash loan, and sent the reported 32 WBNB profit to another address.
Protocol details
Classification
Token
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
OLIFE
Evidence
- report @PeckShieldAlert incident report twitter.com
- report @CertiKAlert incident report twitter.com
- analysis Website reference binance.com
- analysis Blog reference blog.solidityscan.com
- analysis Ocean Life token hack analysis — Flash Loan Attack blog.solidityscan.com
- analysis BSC-based OceanLife (OLIFE) token gets hacked, loses 100% of value crypto.news
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
