PancakeBunny Hack

TOTAL LOST $45.0M

High May 19, 2021 Flash Loan Attacks BNB Smart Chain

What happened

On May 19, 2021, PancakeBunny's BNB Smart Chain yield vault was exploited through flash-loan-assisted manipulation of PancakeSwap liquidity and the protocol's LP-token valuation. The attacker made a small vault position, temporarily distorted relevant PancakeSwap reserves, and caused the reward path to treat a manipulated LP position as having far more value than the underlying performance fee. That inflated valuation allowed the attacker to mint 6,972,455 BUNNY, then sell BUNNY for WBNB before repaying the atomic borrowing.

The protocol said vault funds were not directly breached, but the excess minting collapsed BUNNY's market price and harmed token holders and liquidity providers.

Technical Root Cause

PriceCalculatorBSCV1 derived LP value from instantaneous PancakeSwap reserves, while the minting path trusted that value. The flow also allowed removeLiquidity to consume the pair contract's whole LP balance rather than only LP tokens corresponding to the fee. Together, those assumptions let an atomic attacker manufacture a much larger apparent contribution and excess BUNNY rewards.

Case & protocol details

Classification Oracle / price manipulation in reward minting

Protocol Type Exploit/Flash Loan Attack

Affected asset / contract BUNNY

Official Website pancakebunny.finance/

Protocol Twitter/X @PancakeBunnyFin

Attacker Address 0xa0acc61547f6bd066f7c9663c17a312b6ad7e187

Exploit Transaction 0x897c2de73dd55d7701…5fcce6a979

Attack Timeline

The attacker seeded a small VaultFlipToFlip position, then borrowed WBNB and USDT and left a large WBNB-USDT LP position in the pair contract. Calling getReward routed a tiny performance fee into BunnyMinter.mintForV2. The minter's liquidity-removal path consumed the pair contract's whole LP balance, including the attacker-controlled LP tokens.

It then priced the resulting BUNNY-WBNB position from manipulated spot reserves and minted BUNNY from the inflated value. The attacker sold the excess BUNNY and repaid the flash loans.