LABUBU/OLPC Smart Contract Vulnerability: $1.10M Reported Loss
The OLPC/LABUBU liquidity pool on PancakeSwap V2 (BNB Chain) was exploited, resulting in approximately $1.1 million in losses.
- Reported loss
- $ 1,100,000
- Attack category
- Smart Contract Vulnerability
Incident Overview
The attacker exploited a logic vulnerability in the OLPC token contract’s _update function. Approximately 46 days prior, the OLPC owner had maliciously changed the decimalsValue parameter to an extremely large value (7326680472586200649) and later renounced ownership. A small OLPC transfer triggered massive burns of OLPC and LABUBU tokens from the pool (to the dead address), desynchronizing the pair’s cached reserves. This allowed the attacker to drain a large amount of LABUBU, which was swapped through intermediate pools for ~1.115 million USDT. Funds were bridged to Ethereum and deposited into Tornado Cash.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.