What happened
On 6 October 2022 an attacker made about $290,671 from the RES token on BNB Chain in a flash-loan price-manipulation attack. The RES contract had an external function, thisAToB(), that anyone could call. It swapped the RES held by the contract into the linked ALL token along a RES-USDT-ALL path. BlockSec named this callable function as the root cause.
The attacker ran the attack in two transactions, making about $209K and then about $81K. RES fell about 97%, from roughly $0.23 to $0.006. According to QuillAudits, the attacker swapped the proceeds into BUSD, BNB and other tokens and moved them to another contract. No recovery was reported.
How it happened
- The attacker funded their wallet (
0x986b2e2a1cf303536138d8aC762447500Fd781c6) with 0.5 BNB and deployed an attack contract (0xff333de02129af88aae101ab777d3f5d709fec6f). - They flash-borrowed USDT from PancakeSwap and made a series of buys from the USDT/RES pair, sending the RES to an externally owned address because RES does not allow transfers to contracts. These buys also earned ALL token rewards.
- They called the public
thisAToB(), which made the RES contract swap its own RES through the pool. This shifted the pool's reserve ratio in the attacker's favour. - They sold the ALL tokens for USDT and then sold the RES back into the manipulated USDT/RES pair for more USDT than they had paid.
- They repaid the flash loan and repeated the process in a second transaction (
0xe59fa482...ba96d, then0xef19a4df...609ac), for about $290K in total.
Protocol details
Evidence
- analysis DeFiLlama defillama.com
- analysis RES Token $290K Flash Loan Exploit | QuillAudits (Wayback copy) web.archive.org
- analysis BlockSec alert on RES token attack (fxtwitter mirror of x.com/BlockSecTeam/status/1578041521273962496) api.fxtwitter.com
- analysis DeFiHackLabs RES_exp.sol PoC raw.githubusercontent.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
