What happened
On 6 March 2024, the TGBS/WBNB pair on BNB Chain was drained for about $150,000. The TGBS transfer logic let repeated ordinary self-transfers trigger burns of TGBS held by the liquidity pair, shrinking that reserve without removing WBNB and inflating the token's pool price. A subsequent sale extracted WBNB.
An investigating firm noted that an owner-only reset of the burn-control variable occurred shortly before the attack and did not determine whether the event was an external exploit or a rug pull.
How it happened
- The attack contract repeatedly sent 1 wei of TGBS to itself, invoking the token's ordinary-transfer path.
- That path called the pool-burn routine, which periodically burned 0.3% of the TGBS balance held by the swap pair.
- Repeated burns reduced the pair's TGBS reserve and raised the apparent TGBS price against WBNB.
- The attacker sold TGBS into the distorted pair and extracted WBNB; security reporting records about 366 BNB, or roughly $150,000, as taken.
Protocol details
Classification
Token
Protocol Type
AMM token
Affected asset / contract
TGBS
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
