Palm USD Hack

Reported loss $900K
BNB Chain
Flash Loan Attack

What happened

On July 24, 2023, Palmswap, a derivatives exchange on BNB Smart Chain, lost about $901,000 in USDT to a flash-loan attack on its PlpManager contract. The attacker exploited how the protocol priced its PLP liquidity token against its internal stablecoin USDP (Palm USD).

PLP was valued from the vault's assets under management, and buying USDP with USDT increased that figure. Adding liquidity and buying USDP both worked at about 1:1. After a large USDP purchase, though, PLP redeemed at roughly 1.9 times what it cost. The attacker bought PLP, pushed its value up by buying USDP, redeemed the PLP for almost twice the USDT, sold the USDP back at about 1:1, and repaid the loan.

Palmswap contacted the wallet holding the funds and offered a bounty. CertiK reports that the exploiter returned the stolen funds after negotiation, and Olympix puts the amount returned at $721,450, about 80% of the loss.

Attacker: 0xf84efa8a9f7e68855cf17eaac9c2f97a9d131366

Exploit transaction: 0x62dba55054fa628845fecded658ff5b1ec1c5823f1a5e0118601aa455a30eac9

How it happened

  1. The attacker flash-borrowed 3,000,000 USDT.
  2. Using 1,000,000 USDT, they called buyUSDP() and ended up with about 996,324 PLP, staked as fPLP.
  3. They swapped the remaining 2,000,000 USDT into about 1,993,538 USDP. This raised the vault's USDT balance and, with it, the value the protocol assigned to each PLP.
  4. They called removeLiquidity() and redeemed the PLP position for about 1,956,585 USDT, nearly double what it cost.
  5. They called sellUSDP() to swap about 1,953,430 USDP back for about 1,947,570 USDT, repaid the 3,000,000 USDT flash loan and kept about 901,455 USDT.

Protocol details

Classification Stablecoin / Protocol Logic / Token & Share Accounting
Protocol Type Derivatives
Affected asset / contract USDP
Implementation language Solidity
Protocol links Website @PayPal

Post-Incident Timeline

  • 2023-07-28

    PalmSwap announced return of the 80% of the stolen funds by WhiteHat on their Official Twitter

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes