Digital Asset
Intelligence
Security Incident · BSC Ecosystem

FoxMarket Flash Loan Attack: $118.70K Reported Loss

·Historical incident record

Incident Overview

FoxMarket (a DeFi project on BSC) had its FoxLpBondsPool.stake() function calculate and fix _stakeAmount from a manipulable Pancake AMM spot quote before a large USDT→Fox swap. The attacker used flash loans to skew pair reserves, then addLiquidity used a mismatched ratio; Treasury.lpBonds() trusted the stale value, minted excess Fox tokens, and sent inviter rewards to an attacker-controlled address, which were sold in the same transaction.

Sources & References

Original incident referencehttps://x.com/SlowMist_Team/status/2089196291800908164 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    BounceBit

    Attack methodSmart Contract Vulnerability
    Reported loss$ 3,000,000
  2. Incident date
    Target

    FH Token

    Attack methodSmart Contract Vulnerability
    Reported loss$ 20,000
  3. Incident date
    Target

    LOOPSDAO

    Attack methodPrice Manipulation
    Reported loss$ 690000
  4. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 1,700,000
  5. Incident date
    Attack methodProtocol Logic Vulnerability
    Reported loss$ 3,200,000