What happened
Smart_Bank on BNB Chain was drained after its lending logic valued SBT from the contract’s own instantly mutable balances. An attacker used a PancakeSwap V3 flash loan to inflate the internal SBT price, then borrowed the bank’s USDT reserve against collateral that was materially under-valued outside the manipulated calculation.
Smart_Bank used a self-referential spot price—its own USDT balance divided by its own SBT balance—as the collateral oracle. A caller could move both values with Buy_SBT and immediately borrow against the manipulated quote in the same transaction. The startup gate was also permissionless and based only on a temporarily donated USDT balance.
How it happened
- The attacker flash-borrowed 1.95M BSC-USD/USDT, transferred 950K to Smart_Bank to meet its public startup threshold, and enabled trading.
- They bought 20M SBT, raising the bank’s USDT balance while reducing its SBT inventory.
- Because Smart_Bank quoted SBT using that live balance ratio, the transaction inflated the collateral price immediately.
- The attacker then borrowed 1,966,930 USDT while locking 1,299,884 SBT, repaid the flash loan, and retained about $56K from the bank’s reserve.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
