Locked liquidity did not stop this $14 million crypto pool drain

PancakeSwap Pool Drained $14M Despite Locked Liquidity

Vulnerability in PancakeSwap's V2 Documentation

PancakeSwap's V2 documentation describes LP tokens as receipts representing a provider's share of a pool. They are separate from the two assets traders exchange inside it. The documentation outlines an ordinary redemption process, where a provider selects a share to remove and receives both paired tokens. However, the process does not account for the case where sending receipts to an inaccessible address prevents redemption.

Exploitation of the Vulnerability

The vulnerability was exploited when a permission inside 79AU's token allowed tokens to leave the pool without payment. The tokens were then sold back for USDT, bypassing the need to redeem a liquidity receipt. This resulted in a $14.35 million pool drain.

Investigation

A Bitquery investigation found that 79% of the pool's liquidity-provider receipts had been burned. However, the remaining 21% of unburned receipts were still redeemable. The investigation identified two pull-authorized addresses: the deployer and a newly authorized wallet. Read-only simulations from either allowed removal of about 95% of the pool's remaining 79AU.

Conclusion

The incident highlights a vulnerability in PancakeSwap's V2 documentation. It is essential for the project to review and update its documentation to prevent similar exploits in the future.