Archived tweet

Tweet thread by zokyo:

Yesterday, @BetterBank_io was exploited, resulting in the free minting of favor tokens. Note: We flagged the core risks during the audit. Here’s what happened, what was ignored, and what can be learned. Tweeted at 6:15 AM · Aug 27, 2025 1) Exploit breakdown - Anyone could set up a liquidity pool on @PulseXcom or deploy their own contract using BetterBank’s Favor token. - Using swapExactTokensForFavorAndTrackBonus, attackers were able to perform bulk swaps and farm large bonuses. Tweeted at 4h - Normally, bulk swapping incurs heavy tax fees, but since these LPs weren’t created through BetterBank, they weren’t recognized as official pairs, allowing attackers to bypass taxes entirely. Tweeted at 4h 2) Our audit flagged two related risks Issue 1: Malicious users could exploit the Favor Bonus with flash loans, trading large volumes to mint free bonuses. The real exploit: Didn’t actually use flash loans, but instead used the method in Issue 2. Tweeted at 4h Issue 2: Malicious users could exploit Favor Bonus using bogus tokens via the UniswapWrapper, by deploying their own contract + LP. Tweeted at 4h 3) What went wrong? Although the issues were flagged, they were ultimately downgraded by BetterBank's team as “Low” or “Informational”. Had these findings been taken more seriously and investigated further, the exploit might have been mitigated. Tweeted at 4h Example: Validating the base token during swaps (ensuring the first token in the path ≈ pool.token0() or pool.token1()) would have blocked illegitimate pairs from qualifying for bonuses.E Tweeted at 4h 4) Mitigation Plan We recommend following an approach similar to @ConicFinance to support impacted users: - Create a debt pool - Issue debt tokens to impacted users - Use protocol fees to gradually repay losses, allowing users to redeem or trade their debt tokens Tweeted at 4h We’re truly sorry to see this breach happen. It’s never easy for the community, and we hate to see it. Here’s hoping BetterBank gets back on its feet quickly. Tweeted at 4h For full transparency, we also want to acknowledge where we could have been more precise. Our initial demo used test ETH (a legitimate token), but the issue could be reproduced with any bogus token, something we did not fully demonstrate at the time. While the downgrade Tweeted at 16m

Tweet #4

Image #1:

Image

Image #2:

Image

Tweet #5

Image #1:

Image

Image #2:

Image