BNB Chain Hack Exposes Vulnerability in Token Approvals

A recent hack on the BNB Chain decentralized exchange (DEX) has resulted in the theft of 62.28 WBNB tokens due to an exploitation of existing token approvals from 29 wallets.

According to security researcher ExVul, the attacker used a fake liquidity pool and a lack of proper verification of a Uniswap V3 swap callback to steal the funds.

The hack involved a router on the BNB Chain DEX executing a swap callback in the Uniswap V3 manner, which allowed the attacker to impersonate a legitimate V3 liquidity pool and execute the swap callback on the router.

The attacker started with just one WBNB that was borrowed using a flash swap in PancakeSwap, and then set up a fake pool contract. They invoked the router, specifying the victim as the payer, which gave them access to the victim's allowance. The attacker moved the approved tokens, converted the received funds to BNB, and paid back the original flash swap.

The hack demonstrates the vulnerability of token approvals, which can be used against users if not properly managed. ExVul notes that users should review their permissions going forward as investigations proceed, but warns that assets once transferred cannot be retrieved.