BlockSec: Stake Contract on BSC Exploited for $133,000 via Price Manipulation

On March 27th, market sources revealed suspicious transactions targeting an unknown Stake contract on the BSC chain, resulting in losses of approximately $133,000.

The attacker exploited a vulnerability in the Stake contract that relied on spot prices. By manipulating the price of TUR in the TUR-NOBEL pool, the attacker staked TUR. This inflated price then triggered reward calculations, and rewards were claimed through a referral account, amplifying the gains. Finally, the stolen TUR was converted to USDT for profit.