DLMC exploit analysis

DLMC was a BNB Chain token priced via its contract's livePrice(), computed by token reserves in the registered Pancake USDT/WBNB pool. Two registered buy/sell contracts allowed the same actor to call both within one block: the second call could push livePrice() up by virtue of having bought DLMC, and the first contract had a soldToken function that handed out the DLMC reserve at the same live price. A flash swap into one Pancake contract and out the other let the attacker buy DLMC at the unstale price, sell it at the inflated price, and walk away with almost the entire USDT balance.

The attacker at 0x701bb7b460ae231dbbcfa3d87f0ab5b458429699 used a Pancake USDT/WBNB flash swap to buy DLMC through two registered buy/sell contracts; the second buy inflated DLMCToken's livePrice(), then the first sell returned nearly all of the protocol's USDT for a fraction of the DLMC it had just bought.

DeFiHackLabs reports a total loss of about 222,560.22 USDT. The drain is in 0x151025d3f0a782340a74d30ef33a5fad044b838e74437a803f0652e70c231306 on BscScan. The attacker EOA used a single-purpose helper 0xe81bf6e392eca9ad594b5452ea53cf7071760a04.

What would have prevented it: a livePrice() cached and updated asynchronously, or a soldToken that took a fresh livePrice() snapshot rather than reading it as part of the buy/sell weight calculation. Whichever side is the price oracle needs to read from a source the actor cannot move in the same block.