GDC exploit analysis

GDC's GDCToken on BNB Chain was drained of 35.34 BNB on 2026-09-11 when an attacker chained four separate bugs into a single transaction (attack transaction, block 121253214). DeFiHackLabs reconstructs the chain against the verified GDCToken source and the on-chain trace.

The chain: (1) GDCToken.receive()/depositFor gate callers with an extcodesize check, but a helper deployed via CREATE2 in the same tx as a Moolah flash-loan borrower has no code when the constructor runs, so the gate is evaded. (2) The deposit function misclassifies the Moolah-sourced BNB as user liquidity, which inflates the GDCToken balance backing the PancakeSwap pair. (3) The burn-mismatch path takes the Moolah-injected balance off the chunk of BNB that would have been taxed. (4) withdrawFor runs without a reentrancy guard, so the attacker's fallback re-enters and exits tax-free. The combination lets the attacker drain the PancakeSwap pair's BNB reserve while only depositing the flash-loaned amount and paying no transfer tax.

DeFiHackLabs records the loss as 35.337151495976986490 BNB, reproduced exact to the wei on a BSC fork.

The fix touches all four: a real tx.origin == msg.sender == caller anti-EOA gate, correct classification of flash-loan BNB, a tax applied to the full input not just the user-supplied chunk, and a nonReentrant guard on withdrawFor.