On April 24, 2024, the YIEDL protocol on BSC was exploited via insufficient input validation on the dataList parameter in the redeem function. An attacker bypassed redemption share requirements by manipulating the dataList parameter and profited from repeated token exchanges totaling approximately $150K.

According to intelligence from the SlowMist Security Team, the YIEDL project on the BSC chain was attacked, with the attacker stealing approximately $300,000. In this incident, the reason lies in the contract’s failure to adequately validate the external parameter(dataList) provided by the user during the processing of the redeem function call. This parameter is critical data for controlling asset exchanges, typically containing specific transaction instructions or routing information. The attacker maliciously constructed this external parameter, enabling unauthorized asset transfers.