Analyzed by SlowMist AI👇 1️⃣ Attack Overview 🔍 💥 Attack Type: Missing Access Control leading to malicious burn of LP pool tokens, causing extreme AMM price distortion followed by arbitrage 🎯 Victim Contract: ShiMama/Shibaba LP Pool (0x564cb2bae0b35cfc8c77d94d65015fe898f8f927) 🧑‍💻 Attacker Address: 0xd10880e7591e30a336b28a5855f0ccb4b8c7c8e9 (EOA) 📦 Attack Contract: 0xcf7380462b7ca3e9f1717d17372eb093bf87f8d5 (Dynamically deployed in this transaction) 💰 Profit Amount: Approx. 52.98 WBNB (Net profit, after deducting 30.78 shimama token cost and gas) 2️⃣ Root Cause of Vulnerability 🧠 📄 Contract: ShiMamaProtocol (0x5049d10378356fde0b44c93fa7bb75836f10b49a) ⚙️ Function: executePairBurn(uint256 referenceIn, uint256 minPullFromPair, uint256 deadline) ❗ Defect: This function lacks any form of access control, allowing any external address to call it. The attacker can pass an arbitrarily large referenceIn parameter, combined with pairBurnBpOnSell = 10000 (100% burn ratio), to forcefully extract and burn almost all shimama tokens from the LP pool in one go. 📉 This causes the shimama balance in the LP pool to approach zero, leading to an extreme distortion in the AMM pricing mechanism—allowing the attacker to swap out a large amount of shibaba tokens for arbitrage using a very small amount of shimama. 3️⃣ Critical Vulnerability Code as shown in the figure below. 💻 4️⃣ Attack Step Sequence 🧩 🚀 Preparation Phase (Off-chain): The attacker EOA 0xd108... pre-holds approximately 30.78 shimama tokens. 🔗 On-chain Execution: 🔹Deploy Attack Contract 🔹Query Flash Loan Amount + Approve Repayment 🔹Initiate Flash Loan (≈374,585 WBNB) 💸 🔹Callback: Acquire shimama Tokens 🔹Callback: Query LP Pool shimama Balance 🔹Execute executePairBurn (Core Exploit) 🔹Arbitrage Swap (shimama → shibaba → WBNB) 🔹Extract Profit (~52.98 WBNB) 🔹Repay Flash Loan 🔹Result: LP pool loses massive liquidity (shimama + shibaba). Attacker nets ~52.98 WBNB 5️⃣ Analysis Confidence Statement 📊 ✅ High Confidence (Code Verified) ✅ High Confidence (Trace Verified) ⚠️ Medium Confidence (Some inferred steps, non-critical) 🛡️ Takeaway: Missing access control + extreme parameter settings = catastrophic LP manipulation risk Stay safe.(SlowMist)