The BSC market just can’t seem to catch a break right now, suffering from it’s bloodiest week to date. Big name projects like $CAKE ($40 -> $17) and $BANANA($11 -> $2) are trading at a fraction of their ATH with BNB itself down from a high of $677 to it’s current $320.
To be completely fair, this reversal of market fortunes is not localized to just the BSC, but can be seen happening to just about every other project in the crypto space. Even the biggest players like $BTC and $ETH were no exception, with $ETH falling briefly to $1900 from a high of $4000.
PancakeBunny
The focus today however, is what happened to PancakeBunny. In a devastating turn of events, millions of $BUNNY tokens each trading at $250 at the time were minted in a second and quickly dumped on the market. For context, there were only 500k $BUNNY tokens in circulation before this exploit. According to the charts at BOG, the price plummeted to a low of $2,
though one eagle eyed Twitter user noticed that it briefly fell to just under $1, but was quickly scooped up by some quick handed buyers. At the time of writing, $BUNNY is back up to $25, already making these initial buyers are very handsome profit of 25x.
The exploit
Twitter and PancakeBunny’s official telegram group were instantly flooded with messages, with plenty of investors demanding information and (understandably) worried about their funds held in PancakeBunny. Since then, some official information has been released, with PancakeSwap also stepping in to help clarify how this exploit occurred. It’s this tweet however, from a user going by the username FrankResearcher that explains it best, giving us the exact figures used in the exploit.
We now know that there were no security issues with the vaults in PancakeBunny, meaning that user funds were not compromised. The hacker exploited the minting condition for $BUNNY (3 $BUNNY minted for every 1 $BNB in fees) by borrowing a large sum of money from Pancakeswap with a flash loan. In simple terms, if you had started the day with 10 $BUNNY tokens, you still have those 10 $BUNNY tokens. The only problem is that the current low price of $BUNNY means that your 10 $BUNNY are now worth $250 instead of $2500.
Aftermath
It remains to be seen what PancakeBunny will do to salvage the situation. Official information from the team seem to be focused around damage control and assuring users that their underlying funds are safe. Rumors of rolling back the chain or creating a version 2 of $BUNNY are being whispered on social media sites, but we’ll just have to wait and see what happens.
To end on a slightly more optimistic note, there has been one positive to this entire fiasco. ApeRocket, a project that markets itself as being to Apeswap what PancakeBunny is to Pancakeswap, has delayed their launch. Presumably, this is to review their contracts to ensure that such a situation never occurs and news of this were well received by the community.
The DeFi space is still young, and mistakes will be made. While PancakeBunny is not blameless in the matter, what’s important is that we learn from said mistakes and continue to grow.