Space Godzilla Hack

SpaceGodzilla, a token on BNB Smart Chain, was drained through its own liquidity-adding function in a flash-loan attack on July 13, 2022 (Numen reports it as July 14). The attacker made about 25,378 USD in stablecoins (other estimates put it above $26K) and, according to Numen, swapped the profit to BNB and sent it through Tornado Cash.

The token contract had a swapAndLiquifyStepv1() function that took the USDT and SpaceGodzilla the contract held and added both to its PancakeSwap pair as liquidity. Anyone could call it. Numen identifies it as the root cause: the function added liquidity while the pool's ratio was badly unbalanced. The attacker skewed the pool with borrowed funds, called the function to put the contract's own tokens into the skewed pool, then traded back at a profit.

**Block data**

• Exploiter: 0x00a62eb08868ec6feb23465f61aa963b89e57e57
• Exploit contracts: 0x3d817ea746edd02c088c4df47c0ece0bd28dcd72, 0x05ad60d9a2f1aa30ba0cdbaf1e0a0a145fbea16f
• Exploit transactions: 0x7f183df11f1a0225b5eb5bb2296b5dc51c0f3570e8cc15f0754de8e6f8b4cca4, 0x67ba949a3fa10bea9ab78b6bb0866bef81370c269debcbae920692bc2081bdeb
• Transfer of about $25K to another contract: 0xa74e446aaf0b34a34a4193bda036820944ededbf4d151dcf9757294480c13f4e