Slowmist: A Single Missing Line of Code Drained $111,000 From the DIP Token

A Transfer That Ran Twice

Slowmist flagged the incidental successful a threat quality alert, pinning the nonaccomplishment astatine 111,097.6 USDC. The steadfast said the DIP token’s “_transfer()” relation was missing a “return” connection successful the subdivision that handles trades routed done the Pancakeswap router (an offering that decentralized exchanges usage to swap tokens against liquidity pools). The squad further added:

“The attacker exploited this by calling `skim(router)` to trigger treble DIP transfers, past `sync()` to acceptable the DIP reserve to an highly debased value, manipulating the AMM terms to drain the pool.”

Despite a elaborate breakdown, Slowmist did not sanction the attacker oregon accidental whether the stolen funds could beryllium recovered anytime soon.

The mechanics of the full cognition look to beryllium rather mundane, fixed decentralized exchanges specified arsenic Pancakeswap trust connected automated router contracts to determination tokens betwixt traders and liquidity pools. A token is escaped to adhd customized logic to its ain transportation function, but erstwhile that logic mishandles router interactions, the doorway opens to repeated, unintended payouts.

In the DIP case, the missing “return” meant codification that should person stopped aft 1 transportation alternatively fell done and executed a 2nd time. Each commercialized that touched the router efficaciously paid retired twice, softly bleeding USDC from the pool.

The bug needed nary flash loan, oracle trick, oregon stolen cardinal to enactment (only a spread successful the token’s ain code). Such router-aware and fee-on-transfer tokens are communal connected Binance-linked chains, wherever projects often bolt other behaviour onto modular token templates. Each added subdivision is different spot for a mistake to hide, and automated swaps tin trigger that mistake thousands of times earlier anyone notices.

Part of a Costly 2026 for DeFi

The DIP nonaccomplishment is tiny adjacent to the year’s header breaches, but it fits a dependable drumbeat of code-level failures. Slowmist’s nationalist hack database alone has logged much than 2,150 incidents and astir $37.8 cardinal successful cumulative losses. In caller days, the tracker recorded a $105,000 nonaccomplishment astatine Thetanuts Finance and a $2.1 cardinal Aztec Connect exploit.

Even much specifically, 1 tin spot that smart contract bugs person driven overmuch of the year’s damage, with DeFi protocols having mislaid much than $1 billion to hacks and exploits (as of past month). Slowmist itself traced the Aztec Connect drain to a deprecated declaration and pinned a $174,570 Grok-Bankr theft connected an artificial quality (AI) cause that was tricked into approving a transfer.

Lastly, Bitcoin.com News reported earlier successful the year that Zetachain paused its mainnet aft Slowmist identified a missing entree power successful its GatewayZEVM contract, different lawsuit of a azygous logic spread handing attackers an opening.

With nary betterment confirmed and the attacker inactive unidentified, the DIP occurrence bolsters a recurring acquisition wherever a azygous missing enactment tin beryllium capable to bare a pool, and autarkic audits stay the main enactment of defence arsenic DeFi losses climb.