BlockSec: USDC-OCA liquidity pool on BSC chain attacked, hacker exploits deflation mechanism vulnerability to steal $422,000

PANews February 14 News, according to BlockSec Phalcon monitoring, an unknown USDC-OCA liquidity pool on the BSC chain was attacked, resulting in approximately 422,000 USDC being withdrawn. The attacker exploited a logical vulnerability in the deflationary OCA token's sellOCA() function, which, each time it was called to swap OCA tokens, also removed an equivalent amount of OCA from the liquidity pool, artificially inflating the token's price within the pool.

The attack was completed in three transactions: the first executed the attack operation, while the remaining two were mainly used to pay additional block builder bribes. The attacker paid a total of about 43 BNB plus 69 BNB to 48club-puissant-builder, with an estimated profit of approximately $340,000. Another transaction in the same block at position 52 failed, suspected to have been front-run by the attacker.