What happened
On May 6, 2024 (UTC) the SATURN token's SATURN/WBNB pool on PancakeSwap was emptied, a loss of about 14.16 BNB (roughly $8,300). SATURN had a deflationary "AutoNukeLP" feature: whenever tokens were sent to the pair, the token contract burned SATURN straight out of the pair's balance and then called sync() on the pair, before the incoming transfer landed. That removed one side of the pool's reserves with nothing taken from the WBNB side, so each sell pushed the SATURN price up.
The attacker used a flash loan to buy almost all the SATURN in the pool, then made one sell that triggered a burn big enough to wipe out what was left. With the pool holding almost no SATURN and all the WBNB, a small sell took out nearly all the WBNB.
Attack tx: 0x948132f219c0a1adbffbee5d9dc63bec676dd69341a6eca23790632cb9475312
Attacker: 0xc468D9A3a5557BfF457586438c130E3AFbeC2ff9
How it happened
- The attacker borrowed 3,300 WBNB from a PancakeSwap V3 pool using a flash loan.
- They swapped about 3,200 WBNB for about 101 million SATURN, leaving only about 500,000 SATURN in the pair (the per-sell limit). The bought tokens were sent to the project team's address, which Lunaray says is excluded from the token's per-address trading limits.
- They transferred about 228,833 SATURN into the pair. Because the recipient was the pair,
_transferranautoLiquidityPairTokens, which burned the pair's remaining SATURN reserve and calledsync(), leaving the pool with almost no SATURN and all of its WBNB. - They swapped the SATURN they had just sent in for almost all of the WBNB in the pair, repaid the flash loan plus fee, and kept about 14 to 15 WBNB.
Protocol details
Evidence
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs PoC SATURN_exp.sol raw.githubusercontent.com
- analysis ChainAegis alert on SATURN (X status 1787667253435195841, via fxtwitter) api.fxtwitter.com
- analysis SATURN Hack Analysis (Lunaray, May 8, 2024; Wayback copy) web.archive.org
- analysis SlowMist Hacked - entry 2024-05-06 Saturn hacked.slowmist.io
- analysis BscScan block 38488209 bscscan.com
- analysis SATURN Token Exploit - AutoNukeLP Burns the Pool's Reserve on Every Sell (Crypto Training) crypto.training
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
