Two Exploits in a Span of a Week: How $13.3M Vanished Across BetterBank & Bunni v4

BetterBank Exploit on August 27, 2025

On Aug 27, BetterBank on PulseChain was drained for about $5M. The root mistake was privilege control around minting and supply management. An attacker gained a path to create value without proper checks, inflated supply, then swapped out into liquid assets and exited while balances and limits failed to stop the flow.

On Sep 2, Bunni v2 built on Uniswap v4 lost about $8.3M. The weakness lived in hook logic and accounting. By steering calls through a v4 hook at carefully chosen moments, the attacker broke expected invariants around liquidity updates and deltas, turning bookkeeping gaps into real withdrawals.

This post walks both incidents end to end — what each protocol intended to guarantee, what preconditions the attacker needed, the exact call traces that moved state in their favor, and the minimal fixes that would have closed the doors — stricter role gates and supply caps for BetterBank, and hook-safe accounting, delta checks, and reentrancy boundaries for Bunni v2.

BetterBank Exploit

BetterBank is a revolutionary DeFi protocol that reimagine lending, borrowing, and wealth generation on PulseChain with two native tokens Esteem `$ESTEEM`— is the primary governance and ownership token and Favor starting with `$PDAIF`, `$PLSF`, and `$PLSXF`— designed to power the lending and borrowing ecosystem.

Esteem Token

Favor Token

Hack Analysis

The attacker abused BetterBank’s automated distribution system by purchasing Favor to gain Esteem at 44% of Favor’s purchasing value as rewards in addition to Favor's daily minting rate, he successfully drained 891M DAI. 9.05B PLSX, and 7.40B WPLS.

First, he created 3 malicious contracts:

Second, with the first contract, attacker borrowed 50M DAI and 7.14B PLP tokens from the flash loan he initiated on BetterBank’s DAI-PDAIF pair.

large zoom

Third, using the 7.14B PLP initially borrowed, attacker invoked `removeLiquidity` on `PulseXRouter02` that drained real DAI-PDAIF pool from 1B DAI and 500M PDAIF.

large zoom

Fourth, attacker using a fake token to create a new fake-PDAIF pool on PulseXFactory, minting a quintillion of this fake token while adding minimal liquidity of fake token and draining PDAIF.

large zoom

Fifth, using this fake token attacker executed several swaps in the same fake attacker created to simulate high trading volume and mint Esteem rewards multiple times.

large zoom
large zoom

Sixth, attacker converted all Esteem rewards to almost 3.8B PDAIF which results in inflating PDAIF token supply.

large zoom

Seventh, attacker used part of PDAIF gains to add liquidity into DAI-PDAIF pool with almost 1.09B DAI and 501M PDAIF, resulting in imbalanced pool with excess PDAIF.

large zoom

Eighth, attacker exploited the imbalanced created in DAI-PDAIF pool to swap the surplus PDAIF for 891M DAI, to pay the original flash loan of DAI-PLP back to BetterBank and retained around 891M DAI.

large zoom

attacker managed to repeat the same scheming exploit and successfully retained around 9B PLSX and 7.4B WPLS

How this Exploit Can be Avoided

References and Related Links