PancakeBunny Hack

The PancakeBunny hack leveraged flash loans to manipulate the protocol's pricing oracle and exploit its token minting mechanism. Here's how the attack was executed:

1. The attacker borrowed a large amount of BNB and USDT through flash loans on PancakeSwap
2. They manipulated the price of BUNNY in the PancakeSwap pools by executing a series of trades
3. PancakeBunny's reward calculation relied on this manipulated price to determine how many BUNNY tokens to mint
4. The attacker exploited this to mint approximately 7 million BUNNY tokens
5. They immediately sold these tokens on the market, crashing the price
6. Finally, they repaid the flash loans and walked away with the profits

The key vulnerability was in how PancakeBunny calculated the value of assets for its reward distribution:

// Simplified representation of the vulnerable price calculation
function calculatePrice(address token) public view returns (uint256) {
    // Get the reserves from the PancakeSwap pool
    (uint112 reserve0, uint112 reserve1, ) = pancakeSwapPair.getReserves();
    
    // Calculate price based on reserves
    // Vulnerability: This can be manipulated with flash loans
    uint256 price = (reserve1 * 1e18) / reserve0;
    
    return price;
}

function mintReward(address user, uint256 performanceFee) internal {
    // Calculate amount of BUNNY to mint based on the manipulated price
    uint256 bunnyPrice = calculatePrice(bunnyToken);
    uint256 amountToMint = (performanceFee * 1e18) / bunnyPrice;
    
    // Mint BUNNY tokens to the user
    bunnyToken.mint(user, amountToMint);
}

The main issue was that the protocol relied on the spot price from a single liquidity pool for its calculations, making it vulnerable to manipulation through large trades.