Skip to main content
• 6 min read

LpdFi Exploit: $693.5K
Drained via Spot-Price Manipulation

$693.5K USDC was extracted from LpdFi after flash liquidity distorted LPD's spot price and a one-second daily-interest boundary unlocked an inflated claim.

AUTOSEC.DEVAUTOSEC.DEV
LpdFi Exploit: $693.5K Drained via Spot-Price Manipulation
  • Incident Date: August 2, 2026 at 16:00 UTC (August 3 at 00:00 UTC+8)
  • Target: LpdFi
  • Target Overview: LpdFi was an order-based yield protocol on BNB Chain. Its interest-settlement contract held the protocol's PancakeSwap V2 LPD/USDC liquidity position and used the LPD token's reserve-derived spot price to value new orders.
  • Total Loss: 693,529.79 USDC (~$693.5K) transferred to the attacker's helper contract; the liquidity removal released 700,535.14 USDC, of which 7,005.35 USDC went to LpdFi's configured fee address
  • Attacker EOA: 0x5d289266d85EF671561bA3F253FB79327C193f33
  • Attack Contract: 0x7f5AD0A998Dcb3f5006F0D152BEBC055979EF711
  • Affected Contract: 0xcE6A6e4413D85A136bBaC8AaE6fB46eAa77F295e
  • Affected Network: BNB Chain
  • Attack Vector: Oracle manipulation combined with a daily-interest logic flaw; flash loans supplied temporary capital but were not the root vulnerability

Incident Review & Technical Details​

1. Attack Path​

  1. The attacker assembled roughly $44 million in temporary USDC: At 15:59:59 UTC, transaction 0xbb5b...3588 drew USDC from multiple liquidity sources, including Lista DAO's Moolah, Venus, Aave, Uniswap V4, and several pools. The transaction then sent 43,714,602.62 USDC into the PancakeSwap V2 LPD/USDC pair and received 4,788,064.49 LPD, sharply distorting the pair's spot reserves.
  2. LpdFi accepted the manipulated spot price as an order valuation: The verified contracts show that Lpd.price() derives its value directly from the PancakeSwap pair's current reserves, with no time-weighted average price (TWAP), independent feed, or deviation check. During the distortion, the attack contract transferred only 214,171.52 LPD to LpdFi, while the emitted Buy event recorded a synthetic uAmount of 140,324,732 USDC and an interestTop of 70,162,366 USDC. The attacker then unwound most of the LPD trade and repaid the temporary liquidity.
  3. One second created a full day of interest: The setup transaction recorded the order in issue 18 at 15:59:59 UTC. The next transaction, 0x70bb...15d6, executed at 16:00:00 UTC, when LpdFi's issue counter had advanced to 19. Because getOrder() multiplies uAmount by the daily rate and the number of elapsed issues, a position that existed for one second became eligible for 701,623.66 USDC of interest—the full 0.5% daily return on the manipulated 140.32 million USDC order value.
  4. claimInterest() burned the protocol's entire LP position: Before claiming, the attack contract flash-borrowed 730,607.76 USDC, transferred 3,440.99 USDC to the LPD/USDC pair, and synchronized its reserves. LpdFi's removeLp() calculated the LP tokens needed from the pair's live USDC reserve and used zero minimum-output parameters. The call burned 1,678,049.36 LP tokens, releasing 700,535.14 USDC and 4,059,427.51 LPD to the LpdFi contract.
  5. The inflated claim paid the attacker 99% of the removed USDC: claimInterest() forwarded 693,529.79 USDC to the attack contract and 7,005.35 USDC to the configured fee address. After repaying the second flash loan and routing part of the proceeds, the helper sent 689,529.79 USDC to the attacker EOA. The attacker's net profit is lower than the gross extraction because the setup transaction was funded with 116,495 USDC and paid numerous liquidity fees; the reviewed sources do not provide a complete net-profit accounting.
  6. Secondary reports describe rapid onward movement: PANews, Odaily, TechFlow, and ChainCatcher reported that the proceeds moved through Relay and Tornado Cash. None of the reviewed reports supplied the corresponding transactions or destination addresses, so that laundering path remains [NEEDS VERIFICATION].

2. Impact Scope​

  • Protocol-Level Loss: The exploit transferred 693,529.79 USDC (~$693.5K) to the attacker-controlled helper. This reconciles the original Defimon estimate of roughly $690K with media reports that rounded the incident to $700K.
  • Liquidity Exhaustion: LpdFi burned its complete 1.678 million-token PancakeSwap LP position to satisfy an economically invalid interest claim. Although the removal also returned LPD to the affected contract and sent 1% of USDC to the fee address, the attacker captured 99% of the released USDC.
  • Accounting Exposure: The vulnerable design treated a caller-supplied uAmount, backed by collateral valued at a manipulable spot price, as the basis for interest. It then converted that accounting liability into real USDC by removing protocol-owned liquidity.
  • Ecosystem Contagion: The flash liquidity was repaid within the attack transactions. No reviewed source reports bad debt at the lending venues, losses at PancakeSwap, or a compromise of BNB Chain itself.
  • User and Recovery Status: No verified LpdFi statement, reimbursement plan, pause notice, or fund-recovery update was located as of August 10, 2026 [NEEDS VERIFICATION].

3. Official Statements​

  • LpdFi: No official incident disclosure or post-mortem was located in the reviewed sources as of August 10, 2026. The project's remediation and user-compensation status remain [NEEDS VERIFICATION].
  • Defimon Alerts: In its August 3 analysis, Defimon classified the incident as oracle or price manipulation, identified the absence of TWAP protection in Lpd.price(), and published the attacker, victim, and drain transaction identifiers.
  • Detection Attribution: Several media reports attributed detection to Hexagate while citing Chainalysis. No corresponding public primary analysis from Hexagate or Chainalysis was located, so that attribution remains [NEEDS VERIFICATION].

4. Investigation Progress​

The two core attack transactions, attacker EOA, helper contract, affected contract, PancakeSwap pair, and exact payout split are public on BscScan. The verified source code also confirms the unsafe dependency between spot pricing, order valuation, daily issue accounting, and LP removal.

Several questions remain open:

  • Whether LpdFi paused or disabled the affected contracts after the drain.
  • Whether the 7,005.35 USDC sent to the configured fee address remains recoverable by the project.
  • The attacker's exact net profit after setup capital, liquidity fees, and subsequent routing costs.
  • The transactions supporting reports that funds passed through Relay and Tornado Cash.
  • Whether any user reimbursement, attacker negotiation, or law-enforcement coordination is underway.

AUTOSEC.DEV Solution​

This exploit required four individually dangerous assumptions to compose: a manipulable spot price, caller-defined notional value, cliff-based daily interest, and an uncapped path from accounting claims to protocol-owned LP liquidity.

  1. Secure Code Review — AUTOSEC.DEV reviews oracle consumers and downstream accounting as one system. For a design like LpdFi, we test whether reserve manipulation can inflate uAmount, fuzz transactions across the exact daily issue boundary, and verify that claimInterest() and removeLp() cannot convert an untrusted valuation into an unbounded withdrawal. Reviews also flag zero minimum-output parameters and missing per-claim liquidity caps.
  2. Security Strategy & Planning — A resilient design needs independent or time-weighted price inputs, maximum price-deviation checks, minimum observation windows, per-order and per-epoch payout caps, and an emergency circuit breaker triggered by abnormal reserve or LP-removal changes. AUTOSEC.DEV helps projects define these controls and the monitoring thresholds needed to stop a one-second accounting edge case before it becomes a pool-wide loss.

Reference​