edel-xstock exploit analysis
edel-xstock priced its token against a thin Pancake V3 USDC/EDEL pool with no TWAP guard, so a flash loan moved spot and the next read was inflated. DeFiHackLabs reconstructs the in-pool USDC drain on BNB Chain.
- Reported loss
- 204,215.57 USDC, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-07-01: Price Oracle Manipulation on edel-xstock”.
Analysis1 min read
edel-xstock priced its token via a regular oracle read from a thin Pancake V3 USDC/EDEL pool, without a TWAP guard. The attacker flash-loaned USDC, traded into EDEL to manipulate the pool's spot, and against the corrupted oracle price swapped into the pool's actual USDC balance.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; the drain transaction drained the affected pool's USDC balance within one flash-borrowed leg. The vulnerable contract is an unverified implementation under the project. No Twitter/X alert URL is captured.
What would have prevented it: a TWAP oracle read with a minimum update window, so a flash cannot reset the working price. The same fix applies to most Pancake V3 thin-pool manipulation of this shape.
Other exploits
- Bonzo Lend exploit analysis $9.0M
- Summer Finance exploit analysis $6.0M
- SummerFi exploit analysis 6 Jul 2026
- Vault4626 exploit analysis 29 Jun 2026
- AIDC exploit analysis 28 Jun 2026
- CookFinanceIssuance exploit analysis 27 Jun 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
