On June 5, SlowMist issued a security alert regarding an exploit targeting the DTXT/USDT trading pair on the BNB Smart Chain (BSC). The attacker successfully drained approximately 35,041.106 USDT by manipulating the contract's flawed liquidity detection logic and leveraging a flash loan. SlowMist identified the root cause as a faulty mechanism used to distinguish between adding liquidity, removing liquidity, and selling tokens.
Root Cause: Faulty Balance vs. Reserve Comparison
The DTXT contract determined the type of operation by comparing USDT.balanceOf(pair) with the difference in the pair's reserves. This approach proved exploitable. An attacker was able to directly transfer a negligible amount of USDT (just 1 wei) to the pair contract, causing the on-chain USDT balance to deviate from the internal reserve record. When the balance exceeded the reserve, the contract mistakenly interpreted subsequent large token sales as "adding liquidity."
Attack Breakdown: From Misidentification to Asset Drain
In the actual attack, the attacker first sent 1 wei USDT to the pair address, then executed a large DTXT sell order. Because the balance was now greater than the reserve, the contract wrongly classified the sale as adding liquidity. This bypassed both the sell fee and swapFee logic, effectively granting the attacker a cost-free exit setup.
After this misidentification, the attacker used a flash loan to rapidly add and remove liquidity, further distorting the pair's state. By simultaneously forging a 1 wei USDT balance manipulation, the attacker was able to directly call the Pair.swap function and siphon the real USDT assets from the pool. The multi-step sequence was executed in quick succession, resulting in the loss of over $35,000 worth of USDT.
Alert and Ongoing Monitoring
SlowMist has published a warning for the DeFi community, urging projects to review their liquidity detection mechanisms and avoid relying solely on balance-to-reserve comparisons. The addresses involved have been flagged, and SlowMist's security team will continue to track fund movements to alert users of any subsequent risks.