PancakeSwap pool loses 14.35 million USDT due to token permission exploit

The PancakeSwap pool for 79AU, 79thVault's token, lost 14.35 million USDT on Oct. 7 through two selling wallets, as revealed by a Bitquery investigation. It was found that 79% of the pool's liquidity-provider receipts had been burned. However, a permission within 79AU allowed tokens to exit the pool without payment, enabling their sale for USDT without redeeming a liquidity receipt. PancakeSwap's V2 documentation states that LP tokens are receipts representing a provider's share of a pool, distinct from the assets traded within it. The liquidity guide explains that a provider can redeem a share to receive paired tokens, but sending receipts to an inaccessible address prevents redemption while still allowing swaps. In PancakeSwap's archived pair contract, separate operations manage LP redemption, swaps, and reserve updates. The swap operation checks token input without consuming LP receipts. On Oct. 8 at 12:53 UTC, Bitquery identified two pull-authorized addresses: the deployer and a newly authorized wallet, which could remove about 95% of the pool's remaining 79AU. A snapshot indicated one wallet held the unburned 21% of LP receipts, retaining ordinary redemption rights. A new check is needed to confirm if 79AU's reported exposure has concluded.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.