Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Movie Token (MT) double-count burn — BSC Mar 2026 ~$242K

1. On sells, MT._transfer delivers net tokens to the pair for the swap and adds the same net amount to pendingBurnAmount (PendingBurnRecorded). 2. Anyone can call LP_MINING.distributeDailyRewards() → MT.extractFromPoolForLpMining → executes pending burn from the pair’s MT balance + pair.sync(). 3.…

Mar 2026•BNB Chain•untagged•2 min read

Loss

~$242K (~381.7 WBNB)

Chain

BNB Chain

Category

untagged

Date

Mar 2026

PoC & write-upPoC for your local evm-hack-analyzerDeFiHackLabs PoC · MovieToken_exp.sol

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-03-MovieToken_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/MovieToken_exp.sol.

Summary#

FieldValue
Date2026-03-10
ChainBSC
Loss~$242K (~381.7 WBNB)
Bug classSell path double-counts into pendingBurnAmount; public burn drains pair inventory
Token0xb32979f3A5b426a4A6Ae920f2B391D885Abf4C18 (Movie Token / MT)
Pair0x037E6EB26275DBfE3A5244239BBe973f1A56b449 (MT/WBNB)
LP Mining0x139bd2ECFDE76f5311D7beeb2E05cba6feDE26D6
Attack tx0xfb57c980286ea8755a7b69de5a74483c44b1f74af4ab34b7c52e733fc62dfca6 @ block 85677691

Root cause#

  1. On sells, MT._transfer delivers net tokens to the pair for the swap and adds the same net amount to pendingBurnAmount (PendingBurnRecorded).
  2. Anyone can call LP_MINING.distributeDailyRewards() → MT.extractFromPoolForLpMining → executes pending burn from the pair’s MT balance + pair.sync().
  3. Pair MT reserves collapse while WBNB stays → price inflates → attacker dumps remaining MT for nearly all pair WBNB.

Buy restriction + bypass (required for PoC)#

Open buys to arbitrary addresses revert: “Buying not allowed: tokens can only be obtained through LP mining”.

Live attacker bypass (reproduced in PoC):

  1. Tiny direct pair.swap buy to self + seed tiny LP.
  2. Large swapExactTokensForTokensSupportingFeeOnTransferTokens with to = PancakeRouter (router is allowed).
  3. removeLiquidityETHSupportingFeeOnTransferTokens flushes the router’s entire MT balance to the attacker.

Then: pair flash-swap of WBNB repaid with MT (records huge pending burn) → second buy/flush → distributeDailyRewards → dump.

Addresses#

RoleAddress
Attacker EOA0xDB0901A3254f47c0CE57fFFCE2C730Bc33A1c0e1
Attack contract0xDf7eD22d1FA65eAc11A0806b7bb5F35d4A1e957D
Flash (Moolah)0x8F73b65B4caAf64FBA2aF91cC5D4a2A1318E5D8C
Router0x10ED43C718714eb63d5aA57B78B54704E256024E

PoC#

FieldValue
Folder2026-03-MovieToken_exp
Testtest/MovieToken_exp.sol
ForkBSC block 85677690
RPChttps://bsc-mainnet.public.blastapi.io
Offline anvil_statenot shipped (ONLINE archive)

Run#

BASH
unset ETH_RPC_URL FOUNDRY_ETH_RPC_URL
cd 2026-03-MovieToken_exp
forge test --match-contract MovieToken_exp -vv --gas-limit 100000000

Expected#

  • Profit WBNB wei: ~381746808261289395927 (~381.75 WBNB, matches live ~381.7)

References#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.