Uranium Finance Hack

TOTAL LOST $57.2M

High Apr 28, 2021 Arithmetic Overflow & Underflow Attacks BNB Chain (BSC)

What happened

Uranium Finance was a BNB Chain automated market maker whose v2 pair contracts contained a broken constant-product invariant check. On April 28, 2021, the flaw was used to drain liquidity from 26 pools.

Technical Root Cause

A copied Uniswap V2 pair implementation used inconsistent scaling constants in its fee-adjusted reserve calculation and its K-invariant check, so swaps could pass without preserving the intended constant-product constraint.

Case & protocol details

Classification AMM constant-product invariant failure

Protocol Type Exploit/Other

Affected asset / contract sRADS, U92, RADS

Smart Contract Language Solidity

Official Website uranium.finance/

Protocol Twitter/X @UraniumFinance

Attacker Address 0xc47bdd0a852a88a019385ea3ff57cf8de79f019d

Exploit Transaction 0x5a504fe72ef7fc76df…7893c37991

Attack Timeline

The v2 migration changed the balance-adjustment multiplier from 1,000 to 10,000 but left the comparison side of the K invariant at 1,000 squared. That mismatch let a caller send a trivial amount of an input token, call swap, and withdraw most of the output reserve. The attacker repeated the pattern across 26 pools.