PolyBunny (PancakeBunny on Polygon) hack — July 2021

PolyBUNNY was the Polygon deployment of PancakeBunny, a yield-farming vault aggregator. At 19:17 UTC on 16 July 2021 an attacker inflated the protocol's profit accounting and minted itself a large block of the platform's reward token.

According to the team's post-mortem, the attacker took an Aave flash loan, deposited 0.000000009416941138 SLP worth about $19,203 into a Bunny Vault, then sent 0.000023532935903931 SLP worth roughly $47,990,975 directly to the USDT-USDC MiniChefV2 contract that the vault farmed against. Because the vault derived a depositor's profit from the balance held in that external contract rather than from its own accounting, the transfer made the small deposit look enormously profitable. Calling withdrawAll then minted 2,136,672.974656942582870591 polyBUNNY as a performance reward. The attacker sold the tokens on QuickSwap and repaid the flash loan, ending with 1,281.702952074137533313 ETH, reported as about $2.4 million at the time.

The team's post-mortem records that polyBUNNY fell to just over $2 immediately after the exploit. Vault deposits themselves were not taken; the loss fell on polyBUNNY holders through dilution and the resulting price collapse, which is also why the headline figure and the compensation figure are the same number.

Team Bunny took a snapshot of holders at block 16933434 and committed to distribute a total of $2.4 million in MND tokens as compensation to polyBUNNY holders, with the MND price depending on assets committed to the Mound Vault by 26 July 2021. No source consulted confirms that the distribution was completed or that holders were made whole.

This is a separate event from the May 2021 PancakeBunny exploit on BNB Chain, which used a different price-manipulation route and was far larger.