Leaderboard
1295All-time rank
C

CFC

Jun 15, 2023

$16K
Lost
$16K
Recovered
$0
Net loss
$16K
Unrecovered0% recovered

An attacker exploited CFC's custom transfer logic on a Uniswap V2-style pool by repeatedly transferring tokens to the pair and invoking skim(), triggering the _transfer() function to burn tokens. This reduced the LP pair's actual token balance, allowing the attacker to extract value through the token supply manipulation.

How the exploit worked

View reproducible PoC

Uniswap Skim() token balance attack.

Lost: ~$16k

Source: DeFiHackLabs (SunWeb3Sec)

Target
DeFi
Classification
Token & Share Accounting
Technique
Donation Attack
Attribution
Unknown
Chains
BSC

Event timeline

  1. Jun 15, 2023
    Exploit executed — $16K drained via donation attack
  2. Attributed to Unknown
  3. Recovery status Unrecovered 0%

Data credits

Related incidents