SNOOKER Hack

Reported loss $198K
BNB Chain
Other

What happened

On 2023-05-10 (00:46 UTC) an attacker abused the invitation (referral) rewards in SNOOKER's (SNK) staking contract on BNB Smart Chain. They minted a large amount of SNK and sold it into the SNK PancakeSwap pool, taking about 197,725 BSC-USD (Binance-Peg USDT). Phalcon reported the loss as about 197K and De.Fi as about $190K.

The SNK price fell about 97%. The attack was prepared about ten days earlier, when the same address staked small amounts from ten 'parent' contracts so that rewards could build up.

How it happened

  1. On 2023-04-29 the attacker deployed ten helper contracts, staked a small amount of SNK from each, and left them to accrue rewards.
  2. On 2023-05-10 the attacker flash-swapped 80,000 SNK from the SNK/BSC-USD PancakeSwap pair.
  3. For each parent, the attacker deployed a new child contract, called bindParent to register it under that parent, and staked the entire borrowed SNK balance through the child.
  4. The parent then called getReward. The minter paid invitation rewards by multiplying the parent's accumulated rewardPerToken by the current balance of all its children, so the parent was paid as if the borrowed tokens had been staked the whole time. The child then exited and passed the SNK on to the next round.
  5. After ten rounds the attacker repaid the flash swap and sold the minted SNK into the pair for about 197,725 BSC-USD.

Protocol details

Classification Token / Access Control
Protocol Type Exploit/Other
Affected asset / contract SNK
Implementation language Solidity

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
BNB Chain TrustPad $155K lost BNB Chain BiSwap $865K lost BNB Chain ShadowFi $303K lost Fantom Reaper Farm $1.7M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes