BetterBank $5M DeFi Exploit Uncovers Web3 Vulnerability on PulseChain

A recent security breach has significantly impacted BetterBank, a prominent Web3 protocol in the decentralized finance (DeFi) sector, resulting in an estimated loss of up to $5 million. The exploit, attributed to unauthorized bonus minting through rogue liquidity pairs, critically underscores the vulnerabilities present within relatively nascent DeFi applications. This incident has had a profound effect on both BetterBank’s total value locked (TVL) and the broader PulseChain ecosystem on which it operates.

• BetterBank, a Web3 DeFi protocol on PulseChain, suffered an exploit causing an estimated loss of up to $5 million.
• The attack leveraged a design flaw allowing unauthorized bonus minting via rogue, low-value liquidity pairs.
• Despite an audit, the system failed to adequately vet the quality of liquidity providers, enabling the exploiter to mint significant ESTEEM tokens as rewards.
• BetterBank’s Total Value Locked (TVL) plummeted from $30 million to approximately $7.96 million following the breach.
• The incident also impacted the wider PulseChain ecosystem, notably causing the PulseX token to drop by over 15%.
• BetterBank’s team has paused the protocol, committed to compensation, and plans to relaunch with redesigned smart contracts and a new token airdrop.

The Exploit Mechanism

The core of the attack originated from a fundamental design flaw within BetterBank’s reward smart contract. While originally intended to incentivize liquidity provision for the FAVOR token, the system inadvertently permitted users to create liquidity pairs against virtually any asset, including newly minted, worthless tokens, without sufficient validation. Despite the low or non-existent value of these “rogue” pairs, the exploiter successfully minted substantial amounts of ESTEEM tokens as rewards. Further on-chain analysis revealed the attacker ingeniously circumvented the standard tax on bulk-minting rewards by exploiting these external, untracked liquidity pairs.

BetterBank’s team has confirmed that although the contract responsible for issuing rewards had undergone a security audit, the assessment regrettably did not extend to vetting the quality of FAVOR liquidity providers. This oversight created a critical “low-hanging fruit” vulnerability, enabling malicious actors to exploit the system by generating low-value liquidity and subsequently draining the protocol through unwarranted reward minting.

Financial Repercussions for BetterBank

The financial repercussions for BetterBank have been considerable. Once ranking among the top five DeFi protocols on PulseChain with a Total Value Locked (TVL) of $30 million, the platform’s liquidity sharply declined to approximately $7.96 million post-exploit. Beyond the immediate financial drain, the protocol now faces weeks of intensive work to repair its smart contracts and mitigate significant reputational damage. Compounding its recovery efforts, BetterBank currently carries $10.31 million in borrowed liquidity.

Impact on the PulseChain Ecosystem

The exploit’s ripple effect extended to the broader PulseChain ecosystem, which had recently experienced growth in its DeFi sector, with liquidity recovering above $300 million. Both Pulse and PulseX tokens, integral to the chain’s functionality, were also affected. Following the BetterBank breach, the PulseX token experienced a sharp decline, falling by over 15%. This market reaction underscores how vulnerabilities in a single protocol can create systemic risks across an interconnected blockchain network. The price drop was notably tracked on CoinGecko.

BetterBank’s Response and Recovery Efforts

In immediate response to the incident, BetterBank’s team moved swiftly to pause the protocol and has committed to compensating losses from its reserves. They plan to relaunch the reward program for liquidity providers, incorporating a new token airdrop and a completely redesigned smart contract to comprehensively address the identified vulnerabilities. The team has also attempted to communicate with the hacker by messaging the exploit address; however, no response or white-hat proposal has been received. Reports indicate the attacker has moved 215 ETH to the Ethereum chain, making these funds potentially more susceptible to mixing or swapping, while still retaining approximately 700,000 pDAI that requires bridging to become usable.

Broader Implications for DeFi Security

This incident is part of a broader, concerning trend of exploits targeting relatively smaller DeFi applications. In these instances, the allure of niche tokens can sometimes complicate the process for hackers to trace and liquidate stolen funds. However, such attacks invariably lead to significant reputational and market price losses for the affected protocols, often outweighing the hacker’s final financial gain, even if the stolen stablecoins are successfully liquidated.