This is a lower bound: only assets with reliable historical USD prices are counted, so the actual loss may be higher.
0x431abb27dab05f4e7cdeaa18390fe39364197500BSC0xacb496dd4a8b6b9d1b99d422b8700f6ef932bc10BSCOn BNB Smart Chain, an unprivileged attacker cluster used two public transactions to first create reward-eligible positions and then exploit the public reward contract 0x431Abb27dAB05f4E7cDeAA18390fE39364197500. In tx 0xb650e9f4b9eb023ea65b55ca4d088323e3d5bda377880dedb149a7fd3fd5c15f, the attacker contract 0x791626eb05e60fac973646ac8d67b008b939fe88 bought a public position, bound into the referral tree, called reward selector 0x1f6b08a4, staked 200e18, deployed helper contract 0xfd8043814f72a500f01ddcbbb375a1d56bb1ee17, and repeated the same public priming flow for the helper. In tx 0xbeea4ff215b15870e22ed0e4d36ccd595974ffd55c3d75dad2230196cc379a52, the attacker flash-borrowed BSC-USD from the FCN/BSC-USD PancakePair 0xacb496dd4a8b6b9d1b99d422b8700f6ef932bc10, collapsed the pair BSC-USD balance to 0.02, claimed an inflated FCN reward inside the callback, repaid the pair with only 10,000 BSC-USD plus 100 FCN, and forwarded 503,468.345335579475662703 BSC-USD to the attacker EOA.
The root cause is a direct pricing error in the reward claim path. The reward contract converts a fixed USDT-denominated reward bucket into FCN by reading instantaneous token balances from a manipulable PancakePair inside the same transaction. Because those balances can be flash-manipulated, a same-transaction reserve collapse turns a fixed 10e18 reward bucket into an oversized FCN payout. This is an ACT incident: no privileged keys, governance rights, or private artifacts were required.
250.985538698669186971The vulnerable system is the TRUST / FCN reward system centered on reward contract 0x431Abb27dAB05f4E7cDeAA18390fE39364197500. The contract is not verified on the explorer, but the local decompilation and the live traces show two relevant public entrypoints:
0x1f6b08a4, used during reward-position priming;Stack(uint256), used to stake 200e18;0xd9574d4c, used during the exploit-time reward claim.The price source used by the reward logic is the FCN/BSC-USD pair 0xacb496dd4a8b6b9d1b99d422b8700f6ef932bc10. The updated auditor evidence records that this address is a verified PancakePair, so the flash-swap capability and callback surface are deterministic. The attacker-side contracts 0x791626... and 0xfd804... are not the bug. Their decompilation shows hardcoded tx.origin == 0xa9ed... gates, which identifies them as attacker orchestration contracts rather than protocol components.
The attacker first accumulated public inventory through earlier swaps and transfers, including txs 0xfc090b1dd85d57875d5c7b11ef2e3d131df355ee4444a2ae1dec7cefa708cba9, 0xd2f65c802e0ea6673b85026d9d0be8f429f64f52b4f6045b011065c5aa3f31b7, 0x3dbdc3804d4b176829a74a7726530bc4fdfaa0901838272821c21d6076dcfd0c, 0x8a6a05c19681d3c85d82426952858d5a8bf97ed8625235b4161f5a2b9e89e7c9, 0xcc653611297cded11e089e6d946a1635d89db44b137d9d8888dd3d9a8871c319, and 0xbda4b759099c6e3fc3aee6c60161e87b2f44e07d23824e36c24212b1e2db3956. Those public acquisitions mattered only because they funded the later public priming and claim calls.
This is an ATTACK-class protocol bug, not a benign arbitrage or a mere attacker-orchestration issue. The reward contract uses raw same-transaction pair balances as an oracle for converting a fixed BSC-USD reward bucket into FCN. The invariant that should hold is straightforward: a fixed USDT-denominated reward bucket must convert into FCN using a manipulation-resistant price, so the FCN payout cannot depend on transient same-transaction reserve distortions. Instead, the contract reads BEP20USDT.balanceOf(pair) and FCNToken.balanceOf(pair) during the claim callback and derives the FCN payout before reserves are restored.
The decompiled reward contract shows the pricing and claim paths reading token balances from the stored pair address:
function Unresolved_78023b1c() public payable returns (uint256) {
address var_b = address(store_a);
address(store_b).Unresolved_70a08231(var_b); // pair USDT balance
address(store_c).Unresolved_70a08231(var_b); // pair FCN balance
return var_k / var_c.length;
}
function Unresolved_d9574d4c() public payable {
address var_d = address(store_a);
address(store_b).Unresolved_70a08231(var_d); // pair USDT balance
address(store_c).Unresolved_70a08231(var_d); // pair FCN balance
}
That design is exploitable because PancakePair balances are manipulable within a single flash-swap callback. The exploit trace proves the exact breakpoint: d9574d4c() runs while the pair is temporarily holding only 0.02 BSC-USD and 0.501971077397338362 FCN, so the reward conversion path pays far more FCN than a fair price would allow. The attacker then restores enough balances to satisfy PancakePair settlement while keeping the drained BSC-USD and most of the FCN overpayment.
The priming transaction shows the attacker using only public protocol surfaces to create claimable state. The trace for tx 0xb650... records the exact sequence:
0x90bf82c772f16651d6ae51D42c90c84aE703Eb42::buy(7690)
0x04c5bcFcae55591D72E01c548863F4E754C74339::bindParent(0x041285A02A7fabc448893f6c1766e4B592f46f96)
0x431Abb27dAB05f4E7cDeAA18390fE39364197500::1f6b08a4(...1)
0x431Abb27dAB05f4E7cDeAA18390fE39364197500::Stack(200000000000000000000)
CREATE -> 0xFd8043814f72a500F01ddCBbB375a1d56bB1ee17
0xFd8043814f72a500F01ddCBbB375a1d56bB1ee17::13c4f87c()
0x90bf82c772f16651d6ae51D42c90c84aE703Eb42::buy(6069)
0x04c5bcFcae55591D72E01c548863F4E754C74339::bindParent(0x791626EB05E60FAc973646ac8D67B008b939fE88)
0x431Abb27dAB05f4E7cDeAA18390fE39364197500::1f6b08a4(...1)
0x431Abb27dAB05f4E7cDeAA18390fE39364197500::Stack(200000000000000000000)
That priming step leaves the attacker cluster in a deterministic pre-exploit state. The tx 0xb650... balance diff shows the primary contract starting with 1180008559000000000000 BSC-USD before tx1 and ending tx1 with 505004279500000000000 BSC-USD, while the newly deployed helper finishes tx1 with 335004279500000000000 BSC-USD. The updated profit snapshot uses those observed balances, rather than any estimated mark-to-market figure, to define the ACT success predicate.
The exploit transaction then abuses the pricing breakpoint. The trace for tx 0xbeea4f... records the decisive sequence:
0x791626EB05E60FAc973646ac8D67B008b939fE88::claim(PancakePair, 20000000000000000, 10000000000000000000000, 100000000000000000000)
PancakePair::swap(0, 512963341056079475662703, 0x791626..., data)
0x791626...::pancakeCall(...)
0x431Abb27dAB05f4E7cDeAA18390fE39364197500::d9574d4c()
BEP20USDT::balanceOf(PancakePair) -> 20000000000000000
FCNToken::balanceOf(PancakePair) -> 501971077397338362
FCNToken::transfer(0x791626..., 225886984828802268274)
FCNToken::transfer(0x19C4..., 25098553869866918697)
BEP20USDT::transfer(PancakePair, 10000000000000000000000)
FCNToken::transfer(PancakePair, 100000000000000000000)
BEP20USDT::transfer(0xA9eDec..., 503468345335579475662703)
The same trace shows the reward bucket at storage slot 0x9c6375cd... changing from 0x8ac7230489e80000 (10e18) to 0, which is consistent with a fixed pending reward bucket being consumed at the manipulated price. The pricing math claimed in root_cause.json is consistent with the trace: 10e18 * 0.501971077397338362e18 / 0.02e18 yields the observed 250.985538698669186971 FCN total reward, split into 225.886984828802268274 FCN to the attacker contract and 25.098553869866918697 FCN to 0x19C4....
The balance diff for tx 0xbeea4f... measures the result:
{
"pair_bsc_usd_delta": "-502963341056079475662703",
"reward_fcn_delta": "-250985538698669186971",
"attacker_eoa_bsc_usd_delta": "503468345335579475662703",
"primary_fcn_delta": "125886984828802268274"
}
The pair ends with 10000020000000000000000 BSC-USD and 85501971077397338362 FCN, matching the incident-shaped post-settlement state. Because FCN transfer tax burns 15 FCN and only 85 FCN reaches the pair, the attacker can repay with 100 FCN while the pair’s final FCN balance still reflects only an 85 FCN increase.
The revised success predicate is also deterministic. The attacker cluster’s directly held BSC-USD balances are:
{
"pre_state_cluster_total": "1180008559000000000000",
"post_state_cluster_total": "503803349615079475662703",
"delta_raw": "502623341056079475662703"
}
This conservative direct-BSC-USD delta excludes any valuation of the retained 125887953514529756405 FCN and ignores gas because gas was paid in BNB, not BSC-USD. It still proves a large positive ACT profit.
The attacker cluster is composed of EOA 0xa9edec4496bd013dac805fb221edefc53cbfaf05, primary contract 0x791626eb05e60fac973646ac8d67b008b939fe88, and helper contract 0xfd8043814f72a500f01ddcbbb375a1d56bb1ee17. The end-to-end flow is:
0x741efdb50b789f236b810766b6b7acdd3c0f6e830ab8ac74b5059ca665b8e8c7 to initialize approvals.0xb650..., use buy(7690), bindParent, reward selector 0x1f6b08a4, and Stack(200e18) to create a primary reward position.0xfd804..., transfer public inventory into it, call buy(6069), bind it to the primary contract as parent, and repeat the same reward-priming calls.0xbeea4f..., call the primary contract’s claim/orchestration path, which:
512,963.341056079475662703 BSC-USD from the PancakePair,pancakeCall,d9574d4c() while the pair BSC-USD balance is only 0.02,10,000 BSC-USD plus 100 FCN,503,468.345335579475662703 BSC-USD to the EOA.The critical decision point is the flash-swap callback. Before that callback, the reward contract would price the fixed reward bucket using the real pair inventory. During the callback, it instead prices from manipulated reserves that the attacker controls for the remainder of the transaction.
The measurable impact is twofold:
502963341056079475662703 BSC-USD (502,963.341056079475662703);250985538698669186971 FCN (250.985538698669186971).The attacker cluster also retains material value after settlement:
502623341056079475662703 raw units;503468345335579475662703 raw units;125886984828802268274 raw units;0x19C4a6b4AbFe88161F07C4fA2229a4120ACFd7d5: 25098553869866918697 raw units.The exploit required no privileged keys, no governance powers, and no private attacker artifact beyond fresh contract deployment. Any unprivileged actor able to observe the same public state and use the same pair flash-swap surface can realize the same opportunity while the reward contract continues to trust transient pair balances.
0xb650e9f4b9eb023ea65b55ca4d088323e3d5bda377880dedb149a7fd3fd5c15f0xbeea4ff215b15870e22ed0e4d36ccd595974ffd55c3d75dad2230196cc379a520x741efdb50b789f236b810766b6b7acdd3c0f6e830ab8ac74b5059ca665b8e8c70xfc090b1dd85d57875d5c7b11ef2e3d131df355ee4444a2ae1dec7cefa708cba9, 0xd2f65c802e0ea6673b85026d9d0be8f429f64f52b4f6045b011065c5aa3f31b7, 0x3dbdc3804d4b176829a74a7726530bc4fdfaa0901838272821c21d6076dcfd0c, 0x8a6a05c19681d3c85d82426952858d5a8bf97ed8625235b4161f5a2b9e89e7c9, 0xcc653611297cded11e089e6d946a1635d89db44b137d9d8888dd3d9a8871c319, 0xbda4b759099c6e3fc3aee6c60161e87b2f44e07d23824e36c24212b1e2db39560x431Abb27dAB05f4E7cDeAA18390fE393641975000xACB496dd4A8b6B9D1B99D422b8700F6EF932Bc100xa9edec4496bd013dac805fb221edefc53cbfaf050x791626eb05e60fac973646ac8d67b008b939fe880xfd8043814f72a500f01ddcbbb375a1d56bb1ee170xACB496dd4A8b6B9D1B99D422b8700F6EF932Bc100xb650... and 0xbeea4f...;