Paraluni hack — March 2022

Paraluni was a BNB Chain yield-farming and metaverse project whose staking contract was a fork of SushiSwap's MasterChef. On 13 March 2022, at about 00:04 UTC, an attacker drained it through a reentrancy bug. The contract's depositByAddLiquidity function took a pool identifier and an array of token addresses but never checked that those tokens corresponded to the LP token registered for that pool, and the internal add-liquidity routine carried no reentrancy guard. The attacker deployed two ERC-20 tokens, UBT and UGT, with a modified transferFrom that called back into MasterChef.deposit before the first deposit's accounting had been written. Each cycle credited the same LP tokens twice, letting the attacker withdraw more than had been supplied. CertiK's reconstruction shows the pattern: a PancakeSwap flash loan of roughly 157,000 USDT and 157,000 BUSD, used to mint about 155,935 ParaPair LP tokens, with the doubled credit then unwound, the loan repaid and the difference kept. The attack was repeated across a series of transactions rather than executed once. Published figures converge on approximately $1.7 million. The attacker swapped the proceeds into BNB and then ether, bridged from BNB Chain to Ethereum, and deposited roughly 660 ETH into Tornado Cash across twelve instalments. CertiK recorded the attacker address and the initial attack transaction. No funds were recovered, no individual has been identified or charged, and both CertiK and Halborn attributed the loss to unvalidated user input combined with the missing reentrancy guard.