Safemoon Hack

Reported loss $8.9M
BNB Chain
Public arbitrary-address burn manipulates AMM reserves and drains WBNB liquidity

What happened

On March 28, 2023, an upgrade to SafeMoon's BNB Chain token contract exposed a public burn path that let an attacker burn SFM held by the SFM/WBNB AMM pair. The artificial reserve reduction inflated SFM's pool price, allowing the attacker to sell SFM back into the pair and drain about $8.9 million in WBNB.

Technical root cause

A recent token-contract upgrade made the burn operation callable against tokens held by arbitrary addresses, including the AMM pair. Burning a pool reserve without a corresponding accounting safeguard lets an AMM's reserve ratio and spot price be manipulated. The main exploit used the public arbitrary-address burn, not an admin-key compromise or a conventional oracle flaw.

How it happened

The attacker flash-borrowed 1,000 WBNB, bought SFM, then invoked the broken burn path to destroy almost all SFM held by the AMM pair. They also burned SFM in the token contract to avoid its BNB-collection behavior, called sync() so the pair recorded the distorted reserves, sold their SFM at the now-inflated price for WBNB, and repaid the flash loan.

The exploiter and SafeMoon later agreed that 80% of the stolen liquidity would be returned, with 20% retained as a bounty. The recovered dollar value is an approximate incident-time valuation, not an assertion that all drained assets were returned.

Protocol details

Classification Access Control / Token Logic / AMM Reserve Manipulation
Protocol Type Exploit/Access control
Affected asset / contract SFM
Implementation language Solidity
Protocol links Website @safemoon
Attacker Address 0x286e09932b8d096cba3423d12965042736b8f850
Exploit Transaction 0x48e52a12cb297354a2…c5e533a934

Funds Recovery

80%

Recovered

$7.1M

Net Loss

$1,780,000

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks Flash Loan Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes