New Free DAO was exploited via flash loans when the reward calculation relied solely on deposited balance without protection. The attacker repeatedly flash-loaned funds to claim disproportionate rewards and drain ~$1.25 million in WBNB.

The New Free Dao project on the BSC chain suffered a flash loan attack. According to SlowMist analysis, the main reason for this attack is that the way of calculating rewards in the contract is too simple, and it only depends on the balance of the caller, which leads to arbitrage by flash loans.