Little Boy Plus (LBP) exploited via oracle manipulation and LP-share inflation, resulting in ~$367K loss as attacker flash-loaned USDT and manipulated reserve calculations to mint inflated hashrate emissions.
Security & Exploits ·
Little Boy Plus (LBP) suffered an exploit on BNB Chain resulting in approximately $367,000 in losses. The attacker executed a multi-step manipulation by flash-loaning 7.77 million USDT from Moolah, withdrawing 34 million USDT from PancakeSwap Infinity Vault, and then transferring 5.79 million USDT directly to the LBP/USDT pair before calling pair.mint to inflate reserve calculations.
The attack leveraged the hashrate emission mechanism in LBPHashrate.sol, which calculates emissions using the formula hashAmount = 2 * lpDelta * currentRUsdt / currentTotalLp. By manipulating post-mint reserves, the attacker minted approximately 10.7 million hLBP tokens and triggered repeated reward calls that generated roughly 141,000 LBP tokens. These inflated emissions were then sold back into the pair, generating 21 million USDT in proceeds.
After repaying the initial loans, the attacker converted their remaining gains into approximately 610 BNB. The vulnerability stemmed from the protocol's reliance on untrusted reserve values immediately following liquidity provision operations, allowing attackers to artificially inflate both LP shares and subsequent hashrate distributions without proportional capital commitment.