A security breach on the BNB Chain has resulted in an estimated loss of $133,000 after attackers exploited a vulnerability in a staking contract, according to blockchain security firm BlockSec.
The incident, detected on March 27 by BlockSec’s Phalcon monitoring system, involved suspicious transactions targeting an unidentified “Stake” contract.
Investigators later confirmed that the exploit stemmed from a flaw tied to spot-price dependency within the contract’s reward calculation mechanism.
According to the analysis, the attacker first manipulated the price of the TUR token in a liquidity pool paired with NOBEL.
By artificially inflating the token’s spot price, the attacker was able to stake TUR tokens into the vulnerable contract at exaggerated valuations. This manipulation allowed the attacker to generate disproportionately high staking rewards.
The exploit was further amplified through the use of multiple referral accounts. These accounts were used to repeatedly claim inflated rewards, effectively draining all TUR tokens from the contract.
Once the assets were extracted, the attacker swapped the stolen tokens into Tether, securing profits from the exploit.
BlockSec identified several wallet addresses linked to the attack, indicating a coordinated effort involving multiple accounts.
The firm emphasized that the root cause lies in the contract’s reliance on manipulable on-chain spot prices without adequate safeguards such as time-weighted averages or oracle-based pricing.
This incident highlights a recurring issue in decentralized finance (DeFi), where improper price validation mechanisms can expose protocols to manipulation attacks.
Experts warn that relying solely on liquidity pool prices without protective layers leaves smart contracts vulnerable to flash loan-style exploits and market distortions.
The breach adds to a growing list of DeFi exploits on the BNB Chain ecosystem, raising concerns about smart contract security standards.
Security firms continue to urge developers to adopt more robust pricing models and conduct comprehensive audits to mitigate such risks.
As investigations continue, the incident serves as a reminder of the persistent vulnerabilities in DeFi infrastructure and the importance of proactive security measures.
