xWin Finance

A flashloan attacker exploited invalid slippage control logic in xWin's reward distribution system, which did not properly validate transaction slippage limits. The attacker obtained a flashloan of 76,000 BNB, manipulated the swap price, and extracted 303,998 XWIN tokens by exploiting the broken slippage validation in the _swapBNBToTokens function.