Little Boy Plus DeFi Protocol on BSC Loses About $370,000 in Hack, SlowMist Says

A DeFi mining protocol on BNB Smart Chain (BSC), Little Boy Plus, was hacked, with losses estimated at about $370,000, according to SlowMist monitoring. According to Foresight News, the incident involved approximately 610.555 BNB. SlowMist said the attack stemmed from the `LBPHashrate._update()` function at `0x5e3c...85fe`, which was triggered via a zero-value `transferFrom` call that bypassed OpenZeppelin authorization checks. This reportedly allowed the attacker to call `LBPHashrate.transferFrom(pair, DEAD, 0)` without authorization from the pair, triggering `_harvest(pair)`. SlowMist said `_harvest(pair)` then used `LBP.mintReward(pair, reward)` to mint LBP tokens directly to the PancakePair address. The minted LBP increased the pair’s token balance without increasing its reserves, enabling the attacker to drain USDT through `PancakePair.swap()`.