הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
On August 15, 2026 Fox Market was exploited through its FoxLpBondsPool.stake() bond minting path. The contract read the FOX spot price from the PancakeSwap V2 FOX/USDT pool before allowing the same transaction to move that pool. The attacker used flash liquidity to buy almost all FOX from the pool, while the mint calculation continued using the pre-swap price snapshot, resulting in approximately 88.66M sFOX and 91.3M FOX of reported issuance. The attacker then sold an immediately unlocked ~2.66M FOX referral allocation into the USDT-heavy pool, repaid the flash liquidity, and retained approximately $120K in realized profit
SlowMistתיאור המקור באנגלית
FoxMarket (a DeFi project on BSC) had its FoxLpBondsPool.stake() function calculate and fix _stakeAmount from a manipulable Pancake AMM spot quote before a large USDT→Fox swap. The attacker used flash loans to skew pair reserves, then addLiquidity used a mismatched ratio; Treasury.lpBonds() trusted the stale value, minted excess Fox tokens, and sent inviter rewards to an attacker-controlled address, which were sold in the same transaction.
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
On August 15, 2026 Fox Market was exploited through its FoxLpBondsPool.stake() bond minting path. The contract read the FOX spot price from the PancakeSwap V2 FOX/USDT pool before allowing the same transaction to move that pool. The attacker used flash liquidity to buy almost all FOX from the pool, while the mint calculation continued using the pre-swap price snapshot, resulting in approximately 88.66M sFOX and 91.3M FOX of reported issuance. The attacker then sold an immediately unlocked ~2.66M FOX referral allocation into the USDT-heavy pool, repaid the flash liquidity, and retained approximately $120K in realized profit
SlowMistתיאור המקור באנגלית
FoxMarket (a DeFi project on BSC) had its FoxLpBondsPool.stake() function calculate and fix _stakeAmount from a manipulable Pancake AMM spot quote before a large USDT→Fox swap. The attacker used flash loans to skew pair reserves, then addLiquidity used a mismatched ratio; Treasury.lpBonds() trusted the stale value, minted excess Fox tokens, and sent inviter rewards to an attacker-controlled address, which were sold in the same transaction.
