YOLO Games' Bazaar LBP (Liquidity Bootstrapping Pool) on Blast was exploited on June 11, 2024 for $1.5M. The exitPool function failed to verify msg.sender, allowing anyone to withdraw assets as a liquidity provider. Unchecked function arguments permitted use of BazaarLBPFactoryBlast address as sender.

$1.5 million was stolen from the liquidity pool on the Blast network’s gaming platform YOLO Games. The root cause was the lack of permission checks in the "exitPool" function, allowing anyone to impersonate liquidity providers and drain the pool. The attack was carried out by a white hat hacker, who returned 353 ETH (90% of the stolen funds), approximately $1.27 million.