On June 20, the OLPC/LABUBU liquidity pool on BNB Chain was exploited, with the attacker transferring approximately $1.11 million in assets from related PancakeSwap V2 pools. The core issue was not a standard flash loan, but a discrepancy between the pool's reserve data and its actual balance, which distorted the price.
The attack point highlights a disconnect between reserves and balances.
This incident involved the deflationary mechanism of the OLPC token. Analysis shows that the attacker initiated a small transfer via the contract, subsequently triggering the destruction of tokens within the pool. During this process, approximately 51.9 million OLPC and 124,000 LABUBU tokens were transferred to a burn address.
The issue is that the cached reserve values for the trading pair have not been synchronized, while the actual token balance in the pool has clearly decreased. Once the reserves and balance become misaligned, the constant product market maker mechanism produces distorted prices, creating opportunities for arbitrage.
The attacker drains the remaining liquidity at a low price.
After the price was manipulated, the attacker was able to buy at significantly below-market prices and drain the remaining LABUBU liquidity from the pool, thereby realizing a profit. The report noted that, as of publication, the stolen funds had not yet been cross-chain transferred, nor had they been sent to Tornado Cash or dispersed across multiple addresses.
It is still unclear whether this vulnerability was intentionally introduced. However, preliminary analysis points to the decimalsValue parameter in the OLPC contract.
Invalid parameter or隐患 planted 46 days ago
More in-depth on-chain analysis reveals that approximately 46 days before the attack, the OLPC token owner changed the decimalsValue from 1 to an abnormally large number. This modification enabled the _update() function to potentially trigger excessive token burning, thereby setting the stage for this reserve distortion.
Notably, this parameter had already been set to an abnormal level weeks before the project relinquished contract ownership, raising suspicions that the vulnerability may have existed long before the attack occurred.
Additional information: According to DeFiLlama data, total losses from various crypto attacks since June have risen to approximately $60.03 million. During the same period, Humanity Protocol suffered losses of about $32 million, and Aztec Network also experienced an attack, resulting in losses of 1,158 ETH, 150,000 DAI, and 0.4696 renBTC.