What happened
ShadowFi's SDF/BNB PancakeSwap pool on BNB Smart Chain was emptied on September 2, 2022, the day the project launched after its presale. The SDF token's burn function had no access control, so anyone could burn SDF held by another address. The attacker burned about 10.3 million SDF out of the liquidity pool, which left SDF extremely scarce in the pool and its price inflated, then sold a small amount of SDF for all 1,078 BNB (about $300,000).
The BNB went to Tornado Cash and SDF lost about 98.5% of its value. ShadowFi said presale proceeds were not affected.
How it happened
- The SDF token exposed a burn function that any caller could use against any holder's balance.
- The attacker called it on the SDF/BNB PancakeSwap pair, destroying about 10.3 million SDF held by the pool.
- With almost no SDF left in the pool, the pair priced each remaining SDF against the full BNB reserve.
- The attacker swapped a small amount of SDF into the pool and received about 1,078 BNB, draining its liquidity.
- The BNB was sent to Tornado Cash.
Protocol details
Classification
Token / Access Control
Protocol Type
Exploit/Other
Affected asset / contract
SDF
Implementation language
Solidity
Protocol links
Website
@ShadowFi_
Evidence
- report Report archive.is
- report Report: over $160 Million Lost in DeFi Exploits and Scams in September de.fi
- transaction www.bscscan.com transaction 0xe30d…1018 bscscan.com
- address bscscan.com address 0x6478…2205 bscscan.com
- address www.bscscan.com address 0xf9e3…650a bscscan.com
- analysis DeFiLlama defillama.com
- analysis Attacker exploits bug in ShadowFi to empty $300,000 liquidity pool web3isgoinggreat.com
- analysis SDF price drops to $0 after the ShadowFi hack getblock.net
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
