What happened
The attacker's address:
The attacker:
- WBNB was swapped to CAKE at PancakeSwap
- Sent CAKE to the HUNNY Minter contract
- Staked on CAKE-BNB Hive in PancakeHunny
- HUNNY Minter was “tricked” to mint more HUNNY tokens, namely:
using all the wallet balance to make HUNNYBNB LP, and then uses it to calculate the profit hunnyBnbAmount, which can be easily tampered with by just sending the tokens to the minter contract - The attacker then un-staked from CAKE-BNB Hive to receive the HUNNY tokens from the Minter
- The attacker then sold the HUNNY tokens on PancakeSwap
Stolen funds were transferred to the external address and deposited to the Binance exchange wallet at:
Protocol details
Classification
Token / Token & Share Accounting
Protocol Type
Exploit/Other
Affected asset / contract
HUNNY
Implementation language
Solidity
Protocol links
Website
@PancakeHunny
Evidence
- report Post-mortem medium.com
- report Post-mortem medium.com
- report Report watchpug.medium.com
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
