A decentralized short trading platform on the BNB chain fell victim to a sophisticated flash loan attack on May 13, 2023, resulting in the loss of approximately $87,000. The SellToken project, which operates a decentralized short trading exchange, saw its SELLC token exploited through a price manipulation vulnerability that exposed fundamental flaws in its token pricing mechanism. As Bitcoin trades at $27,192 and Ethereum holds steady at $1,817, the incident serves as a stark reminder that even smaller protocols remain prime targets for attackers leveraging decentralized finance infrastructure against itself.
The Exploit Mechanics
The attacker executed a multi-step flash loan attack that capitalized on a flawed calculation in SellToken’s price oracle. The exploiter initiated the attack by taking a flash loan of roughly 1,902 WBNB from multiple liquidity providers on PancakeSwap. With this borrowed capital, the attacker exchanged 400 WBNB for approximately 4,975,497 SELLC tokens, instantly creating significant sell pressure that distorted the token’s price feed.
Once the price had been artificially manipulated downward, the attacker used approximately 13.37 BNB to initiate a short position on SELLC tokens through SellToken’s own shorting mechanism. The manipulated price made the short position appear highly favorable. The attacker then swapped the 4,975,497 SELLC tokens back for 408 WBNB on PancakeSwap, further driving the price down and profiting from the short position by approximately 39.28 WBNB.
To complete the attack cycle, the exploiter withdrew the shorting profits from SellToken’s contracts and used the remaining balances to repay the flash loan. The net profit amounted to approximately 279 BNB, equivalent to roughly $87,000 at the time of the exploit. The attacker had initially funded the attack contract with 1.8 BNB to establish a high-price position that enabled the exploit sequence.
Affected Systems
The attack targeted SellToken’s core smart contracts on the BNB chain, specifically its short trading exchange mechanism and the price calculation module that determined token valuations for short positions. PancakeSwap, the primary decentralized exchange on BNB chain, served as the liquidity source for both the flash loan and the token swaps that facilitated the price manipulation.
The vulnerability was not in PancakeSwap itself but rather in SellToken’s reliance on spot prices from the DEX without adequate safeguards against flash loan-induced manipulation. The protocol lacked time-weighted average price oracles, circuit breakers, or minimum delay requirements that could have prevented the rapid price distortion.
On-chain data from BscScan shows the exploiter’s address and attack transactions are fully traceable, though recovery of funds appears unlikely given the nature of the exploit and the speed at which the attacker converted profits.
The Mitigation Strategy
Preventing flash loan price manipulation attacks requires a multi-layered approach to oracle security. First, protocols should implement time-weighted average price feeds rather than relying on instantaneous spot prices from a single DEX. Chainlink and other decentralized oracle networks provide manipulation-resistant price data that averages prices over time windows, making flash loan attacks economically unfeasible.
Second, short trading protocols in particular need to implement minimum holding periods or delayed settlement mechanisms. By requiring positions to remain open for a minimum duration, attackers cannot execute the instant borrow-manipulate-profit-repay cycle that flash loans enable.
Third, comprehensive audit procedures with multiple blockchain security firms are essential before launching any DeFi protocol. The root cause of this exploit—a flawed token price calculation—is the type of vulnerability that rigorous auditing typically identifies. Multiple independent audits from established firms like Trail of Bits, OpenZeppelin, or Certik provide overlapping layers of security review.
Lessons Learned
The SellToken exploit reinforces several critical lessons for the DeFi ecosystem. Flash loan attacks remain one of the most common attack vectors, accounting for a significant portion of the $93.4 million stolen from crypto projects in April 2023 alone across 41 separate exploits. The accessibility of flash loans—which require zero upfront capital—means that any protocol with a price manipulation vulnerability is an attractive target.
Smaller protocols face disproportionate risk because they often lack the resources for comprehensive security audits while operating with thinner liquidity pools that are easier to manipulate. The $87,000 loss from SellToken may seem modest compared to major bridge exploits, but for the protocol’s users, the impact is total.
User Action Required
Users who interacted with the SellToken protocol should immediately review their wallet transactions for any unauthorized activity. Funds remaining in SellToken’s smart contracts should be withdrawn if possible. Community members should monitor the project’s official communication channels for updates on potential remediation or compensation plans. Going forward, users should prioritize protocols that have undergone public audits from multiple security firms and implement robust oracle solutions before depositing significant funds.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before engaging with any DeFi protocol.
1902 WBNB flash loan and nobody thought to add a price deviation check on the oracle. same story different chain
price manipulation via flash loan is the oldest trick in defi. baffling that new protocols still ship without twap oracles in 2023
rekt_ibis nailed it. no price deviation check on a 1902 WBNB flash loan is negligence plain and simple
BNB chain protocols keep getting hit with the exact same attack vector. You would think teams would learn from PancakeBunny and the dozen others.
87k is honestly a small hit compared to what we saw in 2022. the scary part is how simple the exploit was
87k is small until you realize the exploit could have drained everything. attacker got limited by pool depth not by any security measure. pure luck it wasnt worse
attacker borrowed 1902 WBNB, dumped 400 WBNB worth of SELLC to crash the price, then exploited the distorted oracle. textbook flash loan attack and yet teams still dont implement basic circuit breakers