BonfireSwap router exploited via unchecked approval drain, affecting ~65 holders and stealing ~$47K in WBNB.
Security & Exploits ·
An exploit of the BonfireSwap router on BNB Chain resulted in the loss of approximately $47,000 in WBNB and affected roughly 65 token holders. The vulnerability stemmed from an access control flaw in the router's transfer function, which failed to verify that the caller was authorized to spend tokens on behalf of the source address. This allowed an attacker to exploit existing token approvals that holders had previously granted to the router, enabling unauthorized transfers without ownership validation.
The attacker leveraged this unchecked approval mechanism by repeatedly calling the transfer function across approximately 65 accounts that had approved BonfireSwap. The exploit forced the sale of BONFIRE tokens into a Pancake pair and diverted the resulting WBNB proceeds—approximately 66 BNB—to the attacker's own contract. Similar vulnerabilities were identified in related functions named loggedTransfer and simpleTransfer, suggesting a systemic design flaw rather than an isolated issue.
The underlying problem reflects inadequate input validation in the router contract, which permitted arbitrary specification of the token source without proper authorization checks. It remains unclear whether the vulnerability has since been patched, what recovery steps the project intends to take, or whether affected holders will receive restitution.