News linked to both this project and an event.
Odaily news, Slow Mist founder Cosine published an analysis stating that the approximately $1.1 million loss incident in the OLPC / LABUBU liquidity pool on BNB Chain is suspicious. The loss occurred due to a severe imbalance in the OLPC/LABUBU trading pair, caused by a "vulnerability" in OLPC being exploited. Under certain conditions in _update, it is possible to burn OLPC tokens amounting to value * decimalsValue. Normally, decimalsValue is 1, but approximately 46 days before the attack, it was changed by the owner to an extremely large value of 7,326,680,472,586,200,649. A few days later, the OLPC owner renounced ownership, setting it to the zero address.Today, the attacker exploited this extremely large decimalsValue to trigger the Pair reserve burn, allowing a small amount of OLPC to extract a large amount of LABUBU. The attacker ultimately swapped 1.115 million USDT at a low cost. The suspicious point lies in the setting of decimalsValue—why did the OLPC owner set such an abnormally large value?
PancakeSwap has issued a notice regarding abnormal activity in the BNB Chain OLPC/LABUBU liquidity pool, stating that the team has acknowledged community reports and initiated a preliminary investigation.PancakeSwap indicated that initial findings confirm no issues at the smart contract level, and the relevant incident is still under further review. The team will continue to monitor the situation and provide updates as more information becomes available.The platform reminds users to rely on information released through PancakeSwap's official channels and to be cautious of unverified rumors.
according to PeckShield monitoring, the OLPC/LABUBU liquidity pool on BNB Chain's PancakeSwap was attacked. The attacker stole approximately $1.1 million worth of assets. After the incident, the attacker cross-chain transferred the stolen funds to Ethereum and subsequently deposited 633.4 ETH into the mixing protocol Tornado Cash. Additionally, the attacker sent 0.0221 BNB and 0.0411 ETH to a deprecated address. Relevant attack details and fund flows are still under continuous tracking.