What happened
XSURGE, also referred to as SurgeBNB, was attacked on BNB Chain in August 2021 after a flaw in its sell path allowed reentrant calls. A security-lab analysis reported a flash-loan-funded buy-sell-buy cycle that exploited stale supply state and put the theft at about $5 million.
How it happened
- The attacker borrowed BNB through a flash loan and purchased SURGE tokens.
- The attacker called the vulnerable sell path.
- The sell path transferred BNB before updating the relevant supply state.
- During that external transfer, the attacker reentered the buy path while the stale state remained visible and repeated the cycle.
- The attacker accumulated additional SURGE under the distorted state, sold it for BNB, and repaid the flash loan.
Protocol details
Classification
Ecosystem / Reentrancy
Protocol Type
DeFi Protocol
Implementation language
Solidity
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
