What happened
On October 22, 2024, Vista Finance's BNB Smart Chain contract was exploited for an estimated $29,000. A mismatch between flash-loan mint/burn accounting and the balance method used to enforce staking restrictions let the attacker obtain a flash loan, buy ICO tokens and sell value that should have remained staked.
How it happened
- The attacker flash-minted one million VISTA tokens.
- It used the inconsistent balance accounting to bypass the staking restriction in the ICO purchase path.
- It purchased tokens with about $1,500 and sold them for a profit.
- The flash-loan flow then burned the temporary minted balance.
Protocol details
Classification
Token / Token & Share Accounting
Protocol Type
Exploit/Flash Loan Attack
Implementation language
Solidity
Protocol links
@vistafound12
Evidence
- report Report blog.solidityscan.com
- analysis DeFiLlama defillama.com
- analysis Vista Finance Hack Analysis blog.solidityscan.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
