UN Token Hack

UN, a BEP-20 token on BNB Smart Chain, was exploited with a flash loan on June 6, 2023. MetaTrust put the loss at about $26,000; the figure shown here is $26,558. CertiK attributed the exploit to a flawed burning mechanism in the UN token contract.

The attacker borrowed 29,100 BSC-USD from a DODO pool, bought UN from the UN/BSC-USD pair, and then repeatedly sent UN to the pair and called skim() to take the excess back. Because of the flaw in UN's token logic, these rounds reduced the UN held by the pair and pushed the UN price up. The attacker then sold its UN back into the pair for more BSC-USD than it had borrowed, repaid the loan and kept the difference. With the $29,100 loan repaid, the $26,558 profit implies roughly $55,658 of BSC-USD taken from the pair.

**Block data**

• Attacker: 0xf84efa8a9f7e68855cf17eaac9c2f97a9d131366
• Attack contract: 0x98e241bd3be918e0d927af81b430be00d86b04f9
• Exploit transaction: 0xff5515268d53df41d407036f547b206e288b226989da496fda367bfeb31c5b8b