On December 29, 2025, an attacker exploited missing access control in MSCST's releaseReward() function, flash loaning 46.8M GPC tokens to inflate GPC/WBNB price on PancakeSwap and extract ~$130K in BNB profit.

On the BSC network, an unknown smart contract MSCST suffered a flash loan attack, resulting in an estimated loss of approximately $130,000. The root cause of the exploit lies in the lack of access control (ACL) within the releaseReward() function of the MSCST contract, which allowed the attacker to manipulate the price of the GPC token in the PancakeSwap liquidity pool (address: 0x12da).