SlowMist Warns: BSC Protocol Little Boy Plus Hacked for $370K via Zero-Value Transfer Exploit

On June 18, the BSC-based DeFi mining protocol Little Boy Plus suffered a hack, losing approximately $370,000 (about 610.5 BNB). Security firm SlowMist identified the attack and publicly disclosed the vulnerability details.

Zero-Value TransferFrom Bypasses Authorization

SlowMist's analysis traced the root cause to the LBPHashrate._update() function (address 0x5e3c…85fe). When handling a zero-value transferFrom call, the function can bypass OpenZeppelin's standard authorization checks. The attacker, without needing pair approval, simply invoked LBPHashrate.transferFrom(pair, DEAD, 0), triggering the internal _harvest(pair) function.

Minting LBP Tokens Unbalances the Pool

The _harvest(pair) function then called LBP.mintReward(pair, reward), minting LBP tokens directly to the PancakeSwap liquidity pool. These phantom tokens inflated the pool's book balance without a corresponding increase in real reserves, distorting the price. The attacker then used PancakePair.swap() to drain all USDT from the pool.

SlowMist has not disclosed the attacker's identity or fund movements, and the Little Boy Plus team has yet to issue a public statement.