What happened
In August 2021, an attacker used a 10,000 BNB flash loan to exploit a reentrancy and state-ordering flaw in SurgeBNB's buy/sell flow on BNB Chain. Repeated transactions drained roughly 13,112 BNB, reported at about $5M–$5.57M.
Technical root cause
SurgeBNB violated checks-effects-interactions around a price-sensitive sell/buy sequence. External code could run before relevant supply and accounting state was finalized, enabling a cross-function reentrancy and stale-state pricing effect.
How it happened
- The vulnerable sell flow performed an external interaction while price-sensitive supply and accounting state was not yet finalized.
- The attacker flash-borrowed BNB, bought SURGE, then used the stale state in a reentrant sell/buy sequence to obtain an advantageous token price and cash out BNB.
- Technical analysis describes the pattern as repeated across multiple transactions.
- No verified recovered amount has been reported, and no source confirms a specific bridge route; available evidence shows later transfers reaching Binance.
Protocol details
Classification
Protocol Logic / Reentrancy
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
SURGE
Protocol links
Website
@SurgeTokenBSC
Exploit Transaction
0x7e2a6ec08464e8e011…0ea78531d2
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
