PancakeBunny - REKT 2

How earitating.

Two months ago PancakeBunny got rekt on BSC, now the same thing has happened on Polygon.

$2.4 million lost, and their second entry earned on our leaderboard. (#33)

They say there’s a plan to compensate their users, so it seems they’re not ready to give up yet.

Despite the growing accusations of it being “an inside job”, the PancakeBunny TVL is slowly returning.

Try not to lose it this time.

From the official post-mortem.

Attacker’s Address: 0xa6021d8c36b2de6ceb4fe281b89d37d2be321431

Attack TX Log: 0x25e5d9ea359be7fc50358d18c2b6d429d27620fe665a99ba7ad0ea460e50ae55

The attacker made a small deposit in one of the Bunny Vaults and at the same time, made a large deposit directly to MiniChefV2 (SushiSwap)

They then called the function withdrawAll to execute the attack, using the amount deposited in the MiniChefV2 as interest.

The attacker followed the following steps to exploit the polyBUNNY minter:

Deposit 0.000000009416941138 SLP (~19,203 USD) into the polygon.pancakebunny USDT-USDC Vault.

Deposit 0.000023532935903931 SLP (~47,990,975 USD) to the USDT-USDC MiniChefV2 contract on SushiSwap.

This generated a performance fee of 0.000007006743943544 SLP (~14,284,950 USD) and minted 2.1 million polyBUNNY to the attacker

Dump polyBUNNY for WETH

Repay AAVE’s flashloan and exit the attack, gaining 1,281.702952074137533313 ETH.

The price of polyBunny fell from $10 to $1.78.

This same exploit was used on “ApeRocketFi”, a direct fork of PancakeBunny, just 2 days ago.

ApeRocket lost $260K on BSC and $1M on Polygon, yet PancakeBunny didn’t prevent the same thing from happening to them.

Was somebody using the smaller protocol as a test, to check that their technique worked?

If so, why would they risk alerting PancakeBunny to the loophole? Perhaps somehow they knew that wouldn’t be an issue...

Of course, it’s possible that the attackers were not the same person, or that they didn’t realise the same attack vector was possible in the original code.

Somehow that seems unlikely.

Who will send money to PancakeBunny now?

We wish we hadn’t...

REKT는 익명 작성자들에 의한 공공 플랫폼이며, REKT에 작성된 관점이나 내용에 대해서 그 어떤 책임도 지지 않습니다.

기부 (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C

disclaimer:

REKT는 당사 웹 사이트의 익명의 작성자 또는 REKT에 의해 게시되거나 관련된 서비스에서 게시되는 콘텐츠에 대해 어떠한 책임도 지지 않습니다. 당사는 익명 작성자들의 행동 및 게시물에 대한 규칙을 제공하지만, 익명의 작성자가 웹 사이트 또는 서비스에 게시, 전송 혹은 공유한 내용을 통제하거나 책임지지 않으며, 귀하가 웹 사이트 또는 서비스에서 직면할 수 있는 불쾌함, 부적절함, 음란함, 불법 또는 기타 해로운 콘텐츠에 대해서도 책임을 지지 않습니다. REKT는 당사 웹 사이트 또는 서비스 사용자의 온라인 또는 오프라인 행위에 대한 책임을 지지 않습니다.