What happened
Paraluni's March 2022 exploit combined unvalidated token inputs with reentrancy in its MasterChef deposit flow. A callback let the attacker receive double credit for liquidity-provider tokens and withdraw more assets than they had deposited.
Technical root cause
depositByAddLiquidity did not validate token addresses against the selected pool. A reentrant deposit during a token callback increased the balance measured by the outer call, causing the same LP tokens to be credited twice.
How it happened
- Flash-borrowed BTCB and WBNB were used to create LP tokens held by an attacker-controlled contract.
- The attacker called depositByAddLiquidity with malicious token addresses that did not match the pool's reserve tokens.
- A malicious transferFrom callback deposited the LP tokens into MasterChef. The outer liquidity call also counted the resulting balance increase, crediting the attacker twice.
- The attacker redeemed the excess credit and withdrew the underlying assets.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
