Leaderboard
758All-time rank
NerveBridge
Dec 14, 2021
$537K
Lost
$537K
Recovered
$0
Net loss
$537K
Unrecovered0% recovered
Attacker exploited a flaw in Nerve Bridge's MetaPool swap function where the swap function underestimated LP token value compared to swapUnderlying. Using a flash loan attack, the attacker received inflated LP tokens for deposited fUSDT, then removed BUSD liquidity and used swapUnderlying to extract additional fUSDT for a total profit of 900 BNB.
How the exploit worked
View reproducible PoCSwap Metapool Attack.
Lost: 900 BNB
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- Bridge
- Classification
- Protocol Logic
- Technique
- Swap Logic Flaw
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Dec 14, 2021Exploit executed — $537K drained via swap logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)