Ploutoz Finance Hack

Reported loss $372K
BNB Chain
Flash Loan Attack

What happened

Ploutoz Finance, a lending protocol on BNB Smart Chain, was exploited on November 23, 2021 for about $365,000. Its oracle priced DOP collateral from the instant reserves of a PancakeSwap pair. The attacker pushed that spot price up with a swap, posted the overvalued DOP as collateral, and borrowed CAKE, ETH and BTCB.

The borrowed assets were swapped to BNB through ParaSwap and PancakeSwap and sent to Tornado Cash, which had also funded the attacker's gas. No recovery was reported.

How it happened

  1. The attacker, funded from Tornado Cash, deployed an attack contract (0xcd8206410b55e278a9538071a69ef9e185856d24).
  2. A swap in the DOP PancakeSwap pair moved its reserves and inflated DOP's spot price.
  3. Ploutoz's PancakeOracle.latestAnswer() read that instant price, so the protocol valued the attacker's DOP collateral far above its real worth.
  4. Against the inflated collateral, the attacker borrowed CAKE, ETH and BTCB from Ploutoz markets.
  5. The borrowed tokens were swapped to BNB via ParaSwap and PancakeSwap and moved to Tornado Cash.

Protocol details

Classification Other / Oracle Manipulation
Protocol Type Exploit/Flash Loan Attack
Affected asset / contract PTZ
Implementation language Solidity
Protocol links Website @ploutozfinance

Evidence

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
Polygon QuickSwap $220K lost BNB Chain Space Godzilla $26K lost Ethereum Visor Finance $976K lost Ethereum BT.Finance $1.9M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes