LpdFi on BNB Chain was exploited in a flash-loan attack that drained roughly $690,000, according to monitoring from Defimon Alerts. The tracker said the flaw came from LpdFi’s Lpd.price() function, which pulled the LPD price directly from spot reserves in the PancakeSwap LPD/USDC pair without using a time-weighted average price or other manipulation safeguards. By borrowing USDC through a flash loan, the attacker was able to skew the pair’s reserves and make the order’s uAmount represent “interest” worth far more than the value of the LPD collateral behind it. Defimon said the attacker then used claimInterest(), which called removeLp(), to pay out that inflated interest by burning the protocol’s own PancakeSwap LP position, extracting USDC and forwarding 99% of it to the caller. The entire LpdFi LP stack, about 1.68 million LP, was removed, and around 693,000 USDC was paid to the attacker in a single transaction.
LpdFi on BNB Chain was hit by a flash-loan attack that caused losses of about $690,000, according to Defimon Alerts.
Price came straight from spot reserves
Defimon said the root cause was in LpdFi’s Lpd.price() function, which read the LPD price directly from the spot reserves of PancakeSwap’s LPD/USDC pair. It did not use a TWAP or any protection against price manipulation.
With that setup, the attacker borrowed USDC through a flash loan and manipulated the pair reserves. That made the order’s uAmount reflect “interest” worth far more than the value of the LPD collateral.
Protocol LP position was burned
The attacker then used claimInterest(), which called removeLp(), to pay out the inflated interest. In the process, the protocol’s own PancakeSwap LP position was burned to extract USDC, with 99% forwarded to the caller.
Defimon said the entire LpdFi LP stack, about 1.68 million LP, was withdrawn, and about 693,000 USDC was paid to the attacker in a single transaction.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
