Phalcon: Suspicious transactions for unknown BSC projects detected, resulting in over $500,000 in losses

Phalcon posted on X platform that the system detected suspicious transactions targeting unknown projects on BSC, resulting in losses of over $500,000. Due to unverified contracts, it is suspected that this may be due to potential flaws in the reward calculation logic. Contract 0x431abb seems to distribute FCN token rewards to users, which are calculated based on the reserve amount of the FCN-BSC-USD currency pair. The attacker first pledged some tokens, then borrowed BSC-USD from this currency pair, and finally received the reward in the flash loan callback. Due to the decrease in the amount of BSC-USD in this currency pair, 0x431abb miscalculated the reward, resulting in the distribution of too many FCN tokens to the attacker.