SlowMist|Sep 30, 2026 04:00
🚨SlowMist TI Alert🚨
💸 @MCNLabs Loss: ~$92.6k
🔍 Root Cause: LPBonus uses inconsistent reserve values in its reward accounting. AddFistFee divides newly acquired FIST by the MSN reserve when updating oneshareFIST, but CalcPendingUser later multiplies that index by a user weight calculated from the reserve at withdrawal. The attacker reduced the reserve to 89.327788899759978606 MSN during accrual, then raised it to 491.113095162589329323 MSN before triggering UserRemoveLp. This mismatch let one newly registered LP holder claim 1,442,165.713011 FIST even though the intervening reward increment was funded by only 940,041.612768 FIST.
📌 Attacker: 0xb6fff29dd2b5423a159e50877fc4af7a54e76f7a
📌 Victim: 0x52272524a22f941f5489c1233732797314bb054b
📌 Vulnerable Contract: 0x52272524a22f941f5489c1233732797314bb054b
Powered by http://SlowMist.AI
Tx: https://bscscan.com/tx/0xecac1563bbb76fb8fefb4a7da4592260a8c1ddde21d7da62b78a9e3769808e6b
Share To
Timeline
HotFlash
APP
X
Telegram
CopyLink