Techub News reports that, according to BlockSec monitoring, suspicious vulnerability exploits targeting unknown contracts were detected on BSC, possibly involving the LML/USDT staking protocol, resulting in approximately $950,000 in losses. Although the affected contract is not open source, analysis suggests there may be a pricing design flaw: the rewards available seem to be calculated based on TWAP/snapshot prices, and attackers can profit by selling reward tokens at manipulated spot prices through price manipulation and reverse swaps. The attacker first boosted the LML price in the pool through a series of transactions (including setting the recipient address to address(0)). Then, using a previously funded controlled address, they initiated the claim operation to directly receive rewards during the attack period.