What happened
On 31 May 2024 an attacker drained TLN Protocol, a BNB Chain liquidity-farming scheme built on the VOW, VUSD and TLN tokens. The protocol's staking pool minted fresh TLN rewards based on the live USD value of staked VOW/VUSD LP tokens, and its TlnSwap contract swapped any TLN for vUSD at a fixed rate, whether or not that TLN had real backing. Together, these let the attacker mint millions of TLN from a small stake and cash them out for vUSD within a single flash-loan transaction.
SlowMist put the loss at about $280,000. Another report put it at about $160K, and a reproduction of the transaction shows a net gain of about 108K USDT plus about 1.46M VOW (roughly $200K). The attacker's wallet was funded through Tornado Cash. No public statement or compensation plan from the protocol has been found.
How it happened
- The attacker flash-borrowed 19,000,000 USDT and used part of it to create a small VOW/VUSD LP position of about 943 LP tokens, worth only a few thousand dollars.
- They staked that LP in the TLN staking pool. The pool valued the stake using live VOW/USDT and VOW/VUSD reserves and minted about 3.2M TLN as the reward, far more than the LP was worth.
- They called
TlnSwap.lock()on about 3.2M TLN. The contract paid out vUSD at a fixed1000/984rate (about 3.25M vUSD) no matter how the TLN had been minted. - They swapped the vUSD to VOW and then to USDT on PancakeSwap, repaid the flash loan plus fee, and kept the surplus (tx
0x1350cc72865420ba5d3c27234fd4665ad25c021b0a75ba03bc8340a1b1f98a45).
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
