RWT token exploited for $118K via unprotected burn function and flash loan allowing price manipulation on BNB Chain.
Security & Exploits ·
An unprotected burn function in the RWT token contract on BNB Chain enabled an exploit that extracted approximately $118K in value. The vulnerability allowed a sell contract holding owner privileges to burn RWT tokens directly from the RWT/USDT liquidity pool without authorization checks, collapsing the pool's token reserves and artificially inflating RWT's price relative to USDT.
The attacker leveraged this mechanism by flash-loaning 1 million USDT and executing the sell routine 18 times in succession. Each loop swapped RWT to USDT into the pair, added liquidity, then burned roughly 72 million RWT from the pool's reserves before calling sync() to update reserves. This repeated burning depleted the pair's RWT balance while the manipulated price allowed the attacker to withdraw USDT at rates far above fair value. The attacker's address ultimately drained 158.6K USDT and 110 million RWT tokens from the liquidity pool.
The exploit stems from a logic error: the burn function lacked access controls when called from within the pair context, enabling price manipulation through selective reserve destruction rather than market swaps. Whether the sell contract's owner role was granted intentionally or via compromise remains unclear, as does the current status of the affected RWT/USDT pair.