Incident Overview
On May 6th, OSN Token contract was exploited with a hacker's profit of about 110k USD.
On May 6th, the address 0x835B4 exploited the OSN token via the unverified exploiter contract 0x4a5ac. During multiple transactions, the exploiter repeatedly added liquidity using flashloan from the Pancake V3 pool and then performed buy-sell operations, which generated rewards for LP holders via the OSNLpDividendTracker contract, followed by removing liquidity. This allowed the attacker to gain unfair rewards worth approximately $110,000 USD.
Attacker:
https://bscscan.com/address/0x835b45d3…5bc502
Attacker contract:
https://bscscan.com/address/0x4a5acac3…8dafc2
Example of exploit tx:
https://bscscan.com/tx/0x03db9050…ee6681
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to OSN Token, these are the critical security checks that could have prevented this incident (May 2024).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next OSN Token
The OSN Token hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.