Leaderboard
1295All-time rank
C
CFC
Jun 15, 2023
$16K
Lost
$16K
Recovered
$0
Net loss
$16K
Unrecovered0% recovered
An attacker exploited CFC's custom transfer logic on a Uniswap V2-style pool by repeatedly transferring tokens to the pair and invoking skim(), triggering the _transfer() function to burn tokens. This reduced the LP pair's actual token balance, allowing the attacker to extract value through the token supply manipulation.
How the exploit worked
View reproducible PoCUniswap Skim() token balance attack.
Lost: ~$16k
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Token & Share Accounting
- Technique
- Donation Attack
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Jun 15, 2023Exploit executed — $16K drained via donation attack
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)
