PancakeBunny Hack

What happened

On May 19, 2021, an attacker exploited PancakeBunny's reward minting on BNB Smart Chain. Using flash loans of roughly 2.3M WBNB from PancakeSwap pairs plus USDT from ForTube, the attacker skewed the PancakeSwap WBNB-USDT pool so that PancakeBunny's internal price calculator hugely overvalued a tiny performance fee. BunnyMinterV2 minted about 6.97M BUNNY to the attacker, who dumped it for WBNB, repaid the loans and kept 114,631 WBNB.

BUNNY fell from about $220-230 to near $10 within a day. Losses are commonly reported as about $45M; cmichel valued the WBNB profit alone at about $30M. PancakeBunny issued a pBUNNY token and a Compensation Pool for holders and later moved to Chainlink price feeds.

How it happened

1. In a setup transaction, the attacker contract deposited a small amount (about 9.28 LP, roughly $380) of WBNB-USDT PancakeSwap LP into VaultFlipToFlip so it had rewards to claim.
2. In the attack transaction, it flash-borrowed about 2.3M WBNB from seven PancakeSwap pairs and USDT from ForTube.
3. It minted a large amount of WBNB-USDT LP and sent it directly to the pair contract, so the protocol's later removeLiquidity call would return far more WBNB and USDT than the real fee.
4. It swapped about 2.3M WBNB into USDT in the WBNB-USDT pool, distorting reserves and prices.
5. It called VaultFlipToFlip.getReward(). The vault took its performance fee and called BunnyMinter.mintForV2(), which valued the fee with PriceCalculatorBSCV1.valueOfAsset() using manipulated spot reserves and minted 6,972,455 BUNNY to the attacker.
6. The attacker sold the BUNNY for WBNB, repaid the flash loans and kept 114,631 WBNB.

Protocol details

Classification Yield Aggregator / Ecosystem / Oracle Manipulation

Protocol Type Yield

Affected asset / contract BUNNY

Implementation language Solidity

Protocol links Website @PancakeBunnyFin

Security review history

• HAECHI Audit View report

Funds Recovery

0.2%

Recovered

$100K

Net Loss

$44,910,000

Evidence

• report Post-mortem rekt.news
• report Report pancakebunny.medium.com
• report PancakeBunny Postmortem Details Attack Compensation Plan finance.yahoo.com
• transaction PancakeBunny exploit transaction bscscan.com
• analysis PancakeBunny Incident Root Cause Analysis peckshield.medium.com
• analysis DeFiLlama defillama.com
• analysis PancakeBunny security update pancakebunny.medium.com
• analysis BSC PancakeBunny Exploit Post Mortem cmichel.io
• analysis BSC Flash Loan Attack: PancakeBunny ambergroup.io
• analysis Explained: The PancakeBunny Protocol Hack (May 2021) halborn.com
• analysis Hack Track: Pancake Bunny Hack merklescience.com

Understand the attack patterns

Compare incidents →

Flash Loan Attacks Oracle Manipulation & Price Manipulation