BSC Chain LML/USDT Staking Protocol Suffers Price Manipulation Attack, Losses Reach $950,000

ME News reports that on April 1 (UTC+8), BlockSec detected a suspicious exploit targeting an unknown contract on BSC, potentially involving the LML/USDT staking protocol, resulting in approximately $950,000 in losses. Although the affected contract is not open-source, analysis suggests it may have a pricing design flaw: claimed rewards appear to be calculated based on TWAP/snapshot prices, while the attacker was able to sell the reward tokens at manipulated spot prices, profiting through price manipulation and reverse swaps. The attacker first inflated the LML price within the pool through a series of transactions, including paths that set the recipient address to address(0). Subsequently, they initiated a reward claim using previously deposited funds from controlled addresses, thereby qualifying for direct reward claims during the attack. (Source: Foresight News)