What happened
On June 8, 2024, the YYS token on BNB Smart Chain was exploited through the project's own sell contract, and the attacker walked away with about 28,943 BSC-USD (USDT). DeFiHackLabs classifies it as a business logic flaw and puts the loss at about $28K.
The attacker flash-borrowed 4.75 million USDT from a PancakeSwap V3 pool and spent almost all of it buying YYS, which pumped the YYS price in the YYS/USDT pair. They then sold the YYS back through the sell contract 0xcC0F...4Fc9 again and again. The transaction log shows the contract taking a 5% fee on each sale and paying the seller in two ways. On some calls it burned LP tokens it held and sent both sides of the withdrawn liquidity to the seller. On others it sent 47.5% of the YYS into the pair, with the USDT going to the seller, and handed the other 47.5% of the YYS straight back to the seller to sell again. After repaying the loan, the attacker kept the difference, which came out of the pair's USDT and the sell contract's 137,403 burned LP tokens.
Attacker: 0x101723def8695f5bb8d5d4aa70869c10b5ff6340
Attack contracts: 0x832e6540da54d07cb0dfea8957be690c8eb2c6a0, 0x4192abd1466b49be9d1e99918aee99e0dbd65289
Exploit transaction: 0x397a09af6494c0bfcd89e010f5dd65d90f3ee1cf1ff813ce5b0c1d42a1c8dec9
How it happened
- The attacker first deposited 100 USDT into the project's invest contract
0xcC0F...4Fc9under an already-registered referrer, which the PoC notes any previously bound address can serve as. - The attack contract
0x832e...c6a0flash-borrowed 4,750,000 USDT from the PancakeSwap V3 pool0x92b7...3121, then swapped 4,749,900 USDT for about 4,224,261 YYS on the YYS/USDT pair0x4200...7F3F, driving up the YYS price. - It called
sell()with 38,584 YYS. The sell contract sent a 5% fee to0xb381...8548and burned 136,390 LP tokens it held. The pair paid out about 1,018,670 USDT plus 18,328 YYS to the attacker. - It then called
sell()with its whole YYS balance in a loop until under 5,000 YYS remained. On a 4,204,004 YYS sale, for example, the contract sent 1,996,902 YYS (47.5%) into the pair, which paid about 3,701,007 USDT to the attacker, and returned another 1,996,902 YYS to the attacker for the next round. The final small sale again went through LP removal. - The attacker repaid 4,750,475 USDT (loan plus fee) and sent the remaining 28,942.73 USDT to its EOA. The pair was down about 29,362 USDT net, and the sell contract had burned 137,403 LP tokens.
Protocol details
Evidence
- report @0xNickLFranklin incident report x.com
- transaction BscScan transaction 0x397a09af...dec9 (Wayback capture 2024-07-04) web.archive.org
- transaction bscscan.com transaction 0x397a…dec9 bscscan.com
- address bscscan.com address 0x1017…6340 bscscan.com
- analysis DeFiHackLabs YYS_exp.sol proof of concept raw.githubusercontent.com
- analysis DeFiHackLabs past/2024 README: 20240608 YYStoken - Business Logic Flaw raw.githubusercontent.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
