What happened
The attackers' addresses:
The transaction behind the attack:
The root cause is a false deposit bug in the staking logic of Pinecone finance. In particular, the affected vault counts as valid deposits even no tokens are actually transferred in. The hacker has no sufficient PCT balance but stakes 200K PCTs to the vault. However, the tx still succeeds and credits the hacker with 200K valid PCTs staked:
Overall, three hackers gathered 3.5 million PCTs, which were converted into 516.83 BNB (~$200,000).
Protocol details
Classification
Borrowing and Lending / Token & Share Accounting
Protocol Type
Exploit/Other
Affected asset / contract
PCT
Implementation language
Solidity
Protocol links
Website
@PineconeFinance
Evidence
- report Post-mortem medium.com
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
