PolyBUNNY Exploit
Approximate loss
$2.4M
Inflated vault-profit accounting
What happened
On July 16, 2021, profit inflation in PancakeBunny's Polygon deployment enabled approximately 2.14 million polyBUNNY to be minted. The team reported attacker proceeds of about 1,281.7 ETH and proposed $2.4 million in MND-token compensation. BSC BUNNY was unaffected.
Technical root cause
Direct MiniChefV2 deposits were misclassified as earned interest, inflating performance fees and polyBUNNY rewards.
How it happened
- The attacker deposited a small amount into the Polygon USDT-USDC vault.
- A much larger direct deposit into SushiSwap MiniChefV2 was treated as interest when
withdrawAllran. - Inflated performance fees generated excess polyBUNNY.
- The attacker repaid the Aave flash loan and exited with ETH.
Protocol details
Classification
Yield Aggregator / Ecosystem / Token & Share Accounting
Protocol Type
Yield
Affected asset / contract
polyBUNNY
Implementation language
Solidity
Protocol links
Website
@PancakeBunnyFin
Security review history
- HAECHI Audit View report
Evidence
- report PolyBUNNY Post-Mortem & Compensation pancakebunny.medium.com
- report Report reddit.com
- report Report bsc.news
- report Report beincrypto.com
- analysis DeFiLlama defillama.com
- analysis The Tragicomedy of PancakeBunny coinmarketcap.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
