PancakeBunny Flash Loan Exploit

Summary

PancakeBunny was a yield-optimizing "vault" protocol built on top of PancakeSwap on Binance Smart Chain (now BNB Chain). Users deposited LP tokens or single assets into Bunny vaults, which auto-compounded PancakeSwap trading and farming rewards and paid depositors a share of the yield in Bunny's own governance token, BUNNY. At its peak in early-to-mid 2021, PancakeBunny reported total value locked in the billions of dollars and BUNNY traded near its all-time highs. On May 19, 2021, an attacker exploited the mechanism that priced and minted BUNNY rewards, using flash-loaned capital to manipulate on-chain prices and mint a huge quantity of new BUNNY out of nothing, then sold it into thin liquidity. BUNNY's price collapsed roughly 95-96% within minutes (commonly cited as falling from around $146 to about $6), and the attacker netted an estimated $45 million (about 114,000+ WBNB), though contemporaneous reporting on the theoretical peak value manipulated in the transaction cited figures as high as $200 million.

Design (Mechanism)

PancakeBunny's vaults periodically harvested farming rewards from PancakeSwap, reinvested most of them back into the underlying LP position, and minted BUNNY tokens to compensate depositors and the protocol's performance-fee treasury. Critically, the amount of BUNNY minted for a given harvest was calculated using the on-chain, spot-priced value of the harvested tokens (denominated via PancakeSwap pool prices such as USDT/BNB and BUNNY/BNB), rather than an external or time-weighted oracle. This meant the protocol's own token-issuance logic trusted instantaneous AMM pool ratios as ground truth for "how much is this harvest worth, and therefore how much BUNNY should we mint."

The attacker exploited this by taking a large flash loan of BNB (reported near 700,000 BNB) from PancakeSwap, then using it to violently swing the USDT/BNB and BUNNY/BNB pool prices within a single atomic transaction: first pumping BNB's price relative to USDT, then dumping BNB into the BUNNY/BNB pool to crash BUNNY's price relative to BNB. With BUNNY's pool price artificially depressed at the exact moment the protocol's reward-minting logic executed, the minting formula computed that a very large number of BUNNY tokens (reported around 7 million, roughly 114 times more than warranted) were needed to represent the harvested value, and the contract minted them accordingly. The attacker then immediately sold the freshly minted BUNNY back through the pools (recovering value while the price was still artificially low relative to their cost basis), repaid the flash loan, and walked away with the difference — profiting from the discrepancy between BUNNY's real market price and the manipulated mint valuation.

Outcome

BUNNY's market price crashed by roughly 95-96% within minutes of the attack as the newly minted supply was dumped and the market reacted to both the dilution and the loss of confidence. PancakeBunny's team publicly confirmed the incident within hours, characterizing it as an "economic exploit" of the reward-calculation logic rather than a direct smart-contract breach or theft of user-deposited vault funds; user principal held in vaults was reported as not directly stolen, though the collapse in BUNNY's price effectively destroyed the value of reward accruals and battered the protocol's TVL and reputation. The attacker's take was estimated at around $45 million in WBNB. PancakeBunny subsequently patched its price-calculation logic and, according to post-incident analysis, moved toward using more robust price feeds (including external oracle-style sourcing) instead of relying on raw spot AMM prices for reward-minting math. The protocol continued operating afterward but never recovered its prior standing, and BUNNY remained a fraction of its pre-exploit value.

Why it worked

The exploit worked because it targeted an assumption baked into the reward-minting code rather than a memory-safety or access-control bug: that instantaneous AMM pool prices are a trustworthy, manipulation-resistant source of value for on-chain accounting. Flash loans made this cheap and riskless to attempt — the attacker could borrow enormous, uncollateralized capital, move prices within a single atomic transaction, trigger the mint, and repay the loan before the transaction could fail or be front-run, with no capital at risk beyond gas and fees. BSC's very low transaction costs relative to Ethereum at the time made large, multi-step manipulative transactions economically viable.

Why it failed or underperformed

The underlying vulnerability was a well-known DeFi failure pattern by mid-2021 — using spot DEX prices as an oracle for a protocol's internal accounting — that had already been exploited against other projects (e.g., Harvest Finance, Value DeFi, and Alpha Homora-adjacent incidents earlier that year). PancakeBunny's minting logic had not been hardened against this class of attack despite the pattern being publicly documented, and the protocol's rapid TVL growth outpaced its security review cadence. The single-block, all-or-nothing nature of flash-loan attacks also meant there was no opportunity for the protocol or community to intervene once the transaction was broadcast.

Lessons

• Never let an internal token-issuance or collateral-valuation formula depend on a single block's spot AMM price; use time-weighted average prices (TWAPs), external oracles (e.g., Chainlink), or multi-source median pricing that can't be moved within one atomic transaction.
• Flash loans remove the capital constraint that once made large-scale price manipulation impractical; any mechanism that reacts to "current price" must be designed assuming an attacker can temporarily command effectively unlimited capital for one transaction.
• Reward-minting and treasury-accrual logic deserves the same security scrutiny as fund-custody logic — this exploit did not steal deposited principal directly, but manipulating the "print more tokens" pathway was just as economically devastating to token holders.
• Rapid TVL and token-price growth in a young protocol is not evidence of underlying security maturity; audits and design review should scale with, or precede, growth in value at risk.

Redesign (EDITORIAL)

EDITORIAL — hypothesis, not fact. A more resilient design would separate "reward harvesting" from "reward pricing" entirely: harvested tokens could be distributed to depositors pro-rata in their native form (or auto-compounded directly into the vault's LP position) rather than being converted into a valuation used to mint a separate governance/reward token. If a native reward token is required, its issuance rate should be fixed or governance-set per epoch (e.g., a capped BUNNY-per-block emission schedule, as many later yield farms adopted) rather than computed on the fly from harvested-asset spot value, removing the manipulable pricing step altogether. Where price-dependent minting is unavoidable, a mandatory TWAP window (e.g., 30-60 minutes) or a circuit breaker that halts minting when a single transaction moves a reference pool's price beyond a set threshold (e.g., 5-10%) would have blocked this specific attack path while adding minimal friction to legitimate operations.