What happened
PYE smart contract was exploited in a bunch of transactions. The example transaction:
The exploit occurred because of the lack of "k invariant verification" in the swap() routine, meaning that a caller verification was removed in the PYESwapPair. There are suspicions that this was an insider job.
The part of the stolen funds was deposited into the Tornado Cash mixer on the BNB chain, the rest was bridged to Ethereum and deposited into the mixer as well:
Protocol details
Classification
Other
Protocol Type
Exploit/Other
Affected asset / contract
PYE
Protocol links
Website
@PyeEcosystem
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
