A flashloan attacker exploited invalid slippage control logic in xWin's reward distribution system, which did not properly validate transaction slippage limits. The attacker obtained a flashloan of 76,000 BNB, manipulated the swap price, and extracted 303,998 XWIN tokens by exploiting the broken slippage validation in the _swapBNBToTokens function.

The DeFi protocol xWin Finance based on Binance Smart Chain was attacked by lightning loans. The xWin Finance token XWIN has fallen by nearly 90% in 24 hours. The attacker used xWin Finance's "reward mechanism" to continuously add and remove liquidity to obtain rewards. Under normal circumstances, due to the small amount of users added, the gains may be small, or even not enough to pay the handling fees; but in the face of huge amounts of funds, the rewards will become abnormally high.