FoxMarket's bonding pool exploited for $119K via flashloan-enabled price manipulation on the FOX/USDT pair, allowing minting of 91M FOX tokens at artificially inflated rates.
Security & Exploits ·
FoxMarket's bonding pool was exploited for approximately $119K on BNB Chain through a price manipulation attack. The attacker used flashloans to artificially depress the FOX/USDT spot price on PancakeSwap, which the protocol relied on to calculate minting amounts in its staking function. By crashing the swap price, the attacker was able to mint roughly 91 million FOX tokens and 89 million stakedFOX tokens at inflated rates, alongside a 3% inviter reward.
The vulnerability stemmed from the bonding pool's dependence on spot price without time-weighted average price (TWAP) protection. The contract calculated stake amounts directly from PancakeSwap's getAmountsOut function, guarded only by a caller-supplied price band that proved insufficient. The attacker's address executed the exploit in a single transaction, chaining the flashloan, minting, and liquidation steps together before repaying all borrowed funds.
The newly minted tokens were immediately sold across FOX/USDT pools and StableSwap pools to convert the inflated position into stablecoins. The mechanism's lack of separation between pricing and capital efficiency—allowing reward inflation tied to manipulated spot prices—left no mechanism to prevent or detect the attack before completion.