On May 19, 2021, PancakeBunny’s Bunny Protocol was the victim of a flash loan attack. The attacker was able to manipulate price differences to steal 114,631 WBNB worth approximately $45 million.
Inside the Attack
Like many previous attacks on DeFi protocols, this attack on PancakeBunny’s protocol was made possible by a flash loan and the ability for attackers to manipulate the exchange rates of certain tokens on an exchange.
In this case, the attacker manipulated the price of USDT/BNB and BUNNY/BNB to their own advantage.
Manipulating the value of an exchange consists of a few main steps:
- Mint liquidity provider (LP) tokens by depositing a pair of tokens (i.e. BNB and USDT)
- Modify the exchange rate by swapping a large number of one token for another (i.e. WBNB for USDT) on a pool
- Exchange LP tokens for share of invested tokens, taking advantage of unbalanced value
In this case, the attacker manipulated the prices of both USDT/BNB and BUNNY/BNB in their attack. This meant that, when extracting value or exchanging BUNNY for BNB, the attacker received more tokens than they “should” have. As a result, after paying off the flash loan, the attacker had 114,631 WBNB left over, which is the profit from the attack.
Mitigating the Attack
The PancakeBunny team has already taken steps to prevent future attacks of this type. This mainly involves ensuring that an attacker cannot manipulate the exchange rate between different tokens on the protocol.
To prevent this, the Bunny Protocol will no longer calculate the value of swaps internally. Instead, they plan to use the Chainlink contract in their token price oracle to determine a “fair” price for each asset. This prevents an attacker from changing a price so much that they can make a profit.
This use of internal price oracles is a common mistake in DeFi that has resulted in a number of expensive hacks against these protocols. Identifying and eliminating errors like these is a critical part of a security audit of the DeFi smart contracts.
To learn more about Halborn’s smart contract auditing services contact halborn@protonmail.com.