What happened
On October 25, 2022, an attacker used flash-loaned BUSD and an unrestricted ULME token function to manipulate the ULME market on BNB Chain. The attacker used BUSD approvals granted to the ULME contract, raised ULME's price, sold the acquired ULME, repaid the loan and retained about 50,646 BUSD.
How it happened
- The attacker borrowed 1,000,000 BUSD with a flash loan and swapped it for ULME on PancakeSwap.
- It supplied lists of accounts that had approved BUSD to the ULME contract to the public
buyMinerfunction. - That function enabled manipulation of approved users' BUSD, indirectly increasing ULME's price.
- The attacker sold ULME at the raised price, repaid the flash loan and retained about 50,646 BUSD.
Protocol details
Classification
Token / Access Control
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
ULME
Implementation language
Solidity
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
