Little Boy Plus was hacked, resulting in losses of approximately 377,642 USDT , equivalent to 610,555 BNB.
SlowMist reported that the vulnerability lies in the _update function within the LBPHashrate contract. This function can be triggered via a transferFrom command with a value of 0, thereby bypassing OpenZeppelin's permission checking mechanism.
An attacker can call this function without granting permissions, trigger _harvest , and send the Mint Token LBP to the PancakePair address via LBP.mintReward .
The Mint LBP increases the pool balance but does not change the reserves, after which the attacker withdraws USDT via the PancakePair.swap command.
