Unknown Contract on BSC Chain Suffers $100,000 Loss Due to Design Flaw

BlockSec Phalcon reported on the X platform that its system detected an attack on an unknown contract on the BSC chain, resulting in a loss of approximately $100,000. According to Odaily, the root cause was identified as a design flaw in the burn pair mechanism. The attacker executed the attack through two reverse exchanges. Initially, they extracted 99.56% of PGNLZ tokens from the pool during the first exchange. Subsequently, during the second exchange, when selling PGNLZ, the transferFrom function triggered the destruction of 99.9% of PGNLP tokens and performed a sync operation. This led to an increase in the PGNLP price, allowing the attacker to exploit the manipulated price to withdraw nearly all USDT from the pool.