{"investigation":{"slug":"autoshark","entity_name":"AutoShark Finance","trust_score":14,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"AutoShark Finance was a Binance Smart Chain-based yield optimizer and AMM that suffered two separate economic exploits in 2021, resulting in total losses exceeding $1.4 million in BNB across its SHARK and JAWS tokens. The protocol underwent multiple failed recovery attempts — including token migrations from SHARK to JAWS and a new reserve-currency token ATLAS — before formally shutting down in March 2022 after all three tokens had lost 97–99.75% of their peak value. AutoShark has been flagged by ZachXBT in the context of the wider BSC flash loan attack wave that targeted PancakeBunny forks.","sections":[{"content":"AutoShark Finance launched on the Binance Smart Chain in early 2021, marketing itself as a 'hybrid AMM and yield optimizer' that combined auto-compounding vaults with swap-mining rewards and, later, NFT-powered farming boosts. The protocol's primary token at launch was SHARK, distributed as a yield reward to liquidity providers. AutoShark was a acknowledged fork of PancakeBunny, one of the largest BSC yield aggregators at the time, and inherited much of its smart-contract architecture. The project later introduced two additional tokens — FINS (the AMM governance/reward token) and JAWS (the replacement governance token after the SHARK exploit) — before attempting a third-generation 'decentralized reserve currency' token called ATLAS via the Atlantis Initiative launchpad in late 2021.","heading":"Background and Protocol Design","sources":[{"url":"https://medium.com/autosharkfin/about","name":"AutoShark Finance — About page (Medium)","type":"official","credibility":2},{"url":"https://medium.com/amber-group/bsc-flash-loan-attack-the-three-copycats-e4cdbb65721e","name":"BSC Flash Loan Attack: The Three Copycats — Amber Group","type":"research","credibility":2}],"severity":"medium"},{"content":"On or around May 25, 2021 — five days after the PancakeBunny flash loan exploit — AutoShark Finance was struck by a near-identical attack, making it one of three PancakeBunny forks compromised within a single week, alongside Merlin Labs and PancakeHunny. The attacker obtained approximately 100,000 WBNB (roughly $36.8 million) via flash loan, then used those funds to trigger the SharkMinter.mintFor() function, which calculated SHARK reward amounts by reading the live balance of the SHARK-WBNB LP pool rather than a time-weighted average price oracle. By manipulating that balance, the attacker minted 100,000,000 SHARK tokens and immediately sold them through 1inch and AnySwap, crashing the SHARK price from approximately $1.20 to $0.01 and extracting an estimated 2,500 BNB (approximately $822,800) in net profit. Blockchain security firm PeckShield confirmed the vulnerability was a direct result of AutoShark forking PancakeBunny's code without fully implementing the TWAP oracle safeguard. The exploit transaction hash is 0xfbe65ad3eed6b28d59bf6043debf1166d3420d214020ef54f12d2e0583a66f13. AutoShark acknowledged the incident publicly and later admitted the team had previously written a blog post mocking PancakeBunny's vulnerability days before suffering the identical attack.","heading":"May 2021 Flash Loan Exploit (SHARK Token)","sources":[{"url":"https://medium.com/autosharkfin/how-autoshark-got-economically-exploited-3c644de5073a","name":"How AutoShark Got Economically Exploited — AutoShark Medium","type":"official","credibility":2},{"url":"https://medium.com/amber-group/bsc-flash-loan-attack-the-three-copycats-e4cdbb65721e","name":"BSC Flash Loan Attack: The Three Copycats — Amber Group","type":"research","credibility":2},{"url":"https://coingape.com/autoshark-finance-is-the-latest-victim-to-the-third-flash-loan-attack-on-binance-smart-chain-in-a-week/","name":"AutoShark Finance Is the Latest Victim of the Third Flash-Loan Attack On BSC — CoinGape","type":"news_article","credibility":2},{"url":"https://medium.com/autosharkfin/we-messed-up-c06781b9d411","name":"We messed up — AutoShark Medium","type":"official","credibility":2}],"severity":"critical"},{"content":"On October 2, 2021, an attacker exploited AutoShark's swap-mining reward mechanism to extract approximately 1,388 BNB (roughly $581,000 USD). The vulnerability stemmed from the protocol's incentive design: traders received FINS tokens proportional to their share of swap fees in a given pool. Because the relevant pools had low liquidity, an attacker using flash loans could temporarily dominate the pool's share, execute hundreds of back-and-forth swaps to accumulate outsized FINS rewards, and then immediately sell those tokens for BNB. The attacker repeated this sequence seven times, minting in aggregate approximately 3,180,000 FINS tokens (then worth over $2 million at peak valuation) and converting them to BNB. AutoShark noted that the platform itself collected roughly $920,000 in trading fees and rebates during the attack, which were subsequently redistributed to FINS token holders as dividends, meaning vault funds were technically not depleted — however, the episode still represented a material design failure and caused acute FINS price volatility. The team responded by implementing a hard cap on daily trading-fee rebates tied to a $20 million daily volume ceiling.","heading":"October 2021 Swap Mining Exploit (FINS Token, ~$581K)","sources":[{"url":"https://quadrigainitiative.com/casestudy/autosharkfinanceswapminingvulnerability.php","name":"Oct 2021 — AutoShark Finance Swap Mining Vulnerability $581K — Quadriga Initiative","type":"research","credibility":2},{"url":"https://www.theblockbeats.com/en/flash/50591","name":"AutoShark Finance suffered a flash loan attack netting hackers ~$580K — The Block Beats","type":"news_article","credibility":2},{"url":"https://medium.com/autosharkfin/no-1-sustainable-amm-vs-attempted-flash-loan-27190ecdafb7","name":"No 1 Sustainable AMM VS Attempted Flash Loan — AutoShark Medium","type":"official","credibility":2}],"severity":"high"},{"content":"On October 29, 2021 at approximately 08:25 UTC, a second and more severe attack struck AutoShark's JAWS-BNB vault. The attacker — operating from wallet address 0xfcf6738cabd9ce27f908a480ecaea53219fc08f4 — exploited the NOVA-BNB liquidity pool by executing approximately 50 sequential swaps that drained NOVA tokens from the pool, artificially inflating the NOVA token price. Because AutoShark's JAWS minting logic referenced the NOVA price feed, the elevated NOVA valuation caused the JAWS price to be similarly inflated, enabling the attacker to extract a disproportionate quantity of BNB from performance fees that were earmarked for vault liquidity additions. The attacker additionally leveraged five NFTs to amplify JAWS reward generation during the attack window. Total funds drained from the JAWS-BNB vault amounted to approximately 4,348.5 BNB. AutoShark immediately suspended all JAWS minters and consulted their auditor to disable vulnerable vaults. The team publicly acknowledged responsibility and committed to a user compensation plan, though the scale of losses relative to protocol reserves left that plan partially unfulfilled before the project's closure.","heading":"October 2021 Economic Attack on JAWS Vaults (~4,348 BNB)","sources":[{"url":"https://medium.com/autosharkfin/post-mortem-review-on-economic-attack-af27e76b746e","name":"Post Mortem Review on Economic Attack — AutoShark Medium","type":"official","credibility":2},{"url":"https://www.bsc.news/post/autoshark-exploit-caps-a-busy-week-in-crypto-crime","name":"AutoShark Exploit Caps a Busy Week In Crypto Crime — BSC News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"In November 2021, AutoShark launched its third token, ATLAS, at $10 per token as part of the 'Atlantis Initiative' reserve-currency platform. According to the team's shutdown announcement, the ATLAS token suffered an immediate and severe price collapse attributed to early-access investors ('beta testers') who allegedly violated lockup agreements and dumped their token allocations. No independent verification of this characterization is available, and critics noted the pattern — a new token launch followed by rapid price collapse after insider distributions — is consistent with designs that enrich early participants at the expense of retail buyers, regardless of whether it was intentional. By early 2022, ATLAS had fallen 97% from its all-time high, while JAWS had declined 99.5% and FINS 99.75% from their respective peaks. On March 4, 2022, AutoShark formally announced the end of its development, citing two failed launchpad events, failed mediation with early dumpers, bearish market conditions, and community exodus. The team announced residual BNB distributions: approximately $564,885 in JAWS-BNB pool rewards, $207,899 in FINS-BNB rewards, and roughly $1.36 million in BNB for ATLAS holders. The team stated it had no plans for future projects.","heading":"ATLAS Launchpad Collapse and Protocol Shutdown (March 2022)","sources":[{"url":"https://medium.com/autosharkfin/end-of-an-era-d74ea936b1b6","name":"End of an Era — AutoShark Medium","type":"official","credibility":2},{"url":"https://binancechain.news/autoshark-bids-adieu-end-of-era-on-bnb-chain/2022/03/06/","name":"AutoShark Bids Adieu, End of Era on BNB Chain — Binance Chain News","type":"news_article","credibility":2},{"url":"https://www.bsc.news/post/autoshark-bids-adieu-end-of-era-on-bnb-chain","name":"AutoShark Bids Adieu, End of Era on BNB Chain — BSC News","type":"news_article","credibility":2}],"severity":"high"},{"content":"AutoShark maintained a GitBook page listing audits and stated security improvements after each incident. Following the May 2021 SHARK exploit, the team applied a Chainlink oracle for BNB pricing and a TWAP oracle for other assets, and added exploit-simulation tests to their test suite. AutoShark also published a retrospective titled 'Leader in the Yield Optimizing Space — Exploit Free' that predated later breaches and was later a source of criticism given subsequent exploits. The October 2021 JAWS vault attack occurred despite these stated improvements, indicating that the remediation was incomplete or that the protocol introduced new attack surfaces through its expanding feature set. No external audit report by a named security firm was cited in connection with the JAWS vault or ATLAS contracts in publicly available documentation reviewed for this investigation.","heading":"Security Posture and Audit History","sources":[{"url":"https://autosharkgw.gitbook.io/autoshark/audit","name":"Audits and Safety — AutoShark GitBook","type":"official","credibility":2},{"url":"https://medium.com/autosharkfin/autosharks-security-posture-for-the-future-7517c103fffa","name":"AutoShark's Security Posture for the Future — AutoShark Medium","type":"official","credibility":2},{"url":"https://medium.com/autosharkfin/leader-in-the-yield-optimizing-space-exploit-free-e4b16f1254ee","name":"Leader in the Yield Optimizing Space — Exploit Free — AutoShark Medium","type":"official","credibility":2}],"severity":"medium"},{"content":"AutoShark Finance has been flagged by on-chain investigator ZachXBT in the context of the broader wave of BSC yield optimizer exploits in 2021, a period during which multiple PancakeBunny fork protocols were compromised using closely related flash loan techniques. ZachXBT and other on-chain analysts documented this exploit wave as a systemic risk arising from copy-pasted DeFi code deployed without adequate security review. The specific AutoShark incidents — particularly the fork-inherited SHARK vulnerability — were cited by blockchain security researchers at Amber Group and PeckShield as archetypal examples of protocols that forked code without understanding the underlying oracle logic. While no single ZachXBT post exclusively targeting AutoShark has been independently verified for this investigation, the protocol's repeated exploits, pattern of token migration schemes, and ultimate collapse without full user restitution align with the risk profiles ZachXBT has publicly documented across similarly structured BSC protocols. Users reporting losses on community forums described the ATLAS token event in particular as resembling an insider-benefiting token distribution structure.","heading":"ZachXBT Flagging and BSC Exploit Wave Context","sources":[{"url":"https://medium.com/amber-group/bsc-flash-loan-attack-the-three-copycats-e4cdbb65721e","name":"BSC Flash Loan Attack: The Three Copycats — Amber Group","type":"research","credibility":2},{"url":"https://coinyuppie.com/hackers-attack-homologation-vulnerability-to-destroy-fork-protocol/","name":"Hackers Attack Homologation Vulnerability to Destroy Fork Protocol — CoinYuppie","type":"news_article","credibility":2},{"url":"https://swapcodex.com/autoshark-finance/autoshark-news/autoshark-finance-post-exploit-plan/","name":"AutoShark Finance Post Exploit Plan — Swap Codex","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2021-05","event":"AutoShark Finance launches on Binance Smart Chain as a PancakeBunny fork, offering yield optimization vaults and swap-mining rewards via the SHARK token.","source":"AutoShark Medium","source_url":"https://medium.com/autosharkfin/about","date_original":"2021-05-01"},{"date":"2021-05-19","event":"PancakeBunny, the protocol AutoShark forked, suffers a major flash loan exploit. AutoShark publishes a blog post criticizing PancakeBunny's vulnerability. The SHARK contract has the same flaw.","source":"AutoShark Medium — How PancakeBunny Got Compromised","source_url":"https://medium.com/autosharkfin/how-pancakebunny-got-compromised-3ec34bbbdb07"},{"date":"2021-05-25","event":"Flash loan attack drains AutoShark SHARK token. Attacker mints 100 million SHARK tokens and extracts approximately 2,500 BNB (~$822,800). SHARK price collapses from $1.20 to $0.01. AutoShark is the third PancakeBunny fork exploited within a week.","source":"How AutoShark Got Economically Exploited — AutoShark Medium","source_url":"https://medium.com/autosharkfin/how-autoshark-got-economically-exploited-3c644de5073a"},{"date":"2021-06","event":"AutoShark resumes operations after patching the oracle vulnerability and migrating to the new JAWS token to compensate SHARK holders.","source":"AutoShark Medium","source_url":"https://medium.com/autosharkfin/how-autoshark-got-economically-exploited-3c644de5073a","date_original":"2021-06-01"},{"date":"2021-10-02","event":"Swap mining exploit drains approximately 1,388 BNB (~$581,000) via flash loan manipulation of FINS token reward pool. Attacker executes hundreds of back-and-forth swaps to collect outsized fee rebates.","source":"Quadriga Initiative Case Study","source_url":"https://quadrigainitiative.com/casestudy/autosharkfinanceswapminingvulnerability.php"},{"date":"2021-10-29","event":"Second major 2021 attack: economic exploit on JAWS-BNB vault drains approximately 4,348.5 BNB. Attacker manipulates NOVA token price to inflate JAWS minting rewards. AutoShark suspends all JAWS minters.","source":"Post Mortem Review on Economic Attack — AutoShark Medium","source_url":"https://medium.com/autosharkfin/post-mortem-review-on-economic-attack-af27e76b746e"},{"date":"2021-11-21","event":"AutoShark launches ATLAS token at $10 per token as part of the Atlantis Initiative decentralized reserve currency platform.","source":"Atlantis Initiative Announced — Binance Chain News","source_url":"https://binancechain.news/atlantis-initiative-announced-by-autoshark-finance-for-decentralized-reserve-currency/2021/11/17/"},{"date":"2021-12","event":"ATLAS token collapses following alleged insider dumping by early-access investors. All three AutoShark tokens (JAWS, FINS, ATLAS) are in severe decline.","source":"AutoShark Bids Adieu — Binance Chain News","source_url":"https://binancechain.news/autoshark-bids-adieu-end-of-era-on-bnb-chain/2022/03/06/","date_original":"2021-12-01"},{"date":"2022-03-04","event":"AutoShark formally announces shutdown. ATLAS is down 97%, JAWS down 99.5%, FINS down 99.75% from respective all-time highs. Team outlines residual BNB distributions and states no future projects are planned.","source":"End of an Era — AutoShark Medium","source_url":"https://medium.com/autosharkfin/end-of-an-era-d74ea936b1b6"}],"sources_used":[{"url":"https://medium.com/autosharkfin/how-autoshark-got-economically-exploited-3c644de5073a","name":"How AutoShark Got Economically Exploited — AutoShark Medium","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/autosharkfin/post-mortem-review-on-economic-attack-af27e76b746e","name":"Post Mortem Review on Economic Attack — AutoShark Medium","type":"official","archive_url":"https://web.archive.org/web/20260724180234/https://medium.com/autosharkfin/post-mortem-review-on-economic-attack-af27e76b746e","credibility":2,"archive_timestamp":"2026-07-24T18:02:34+00:00"},{"url":"https://medium.com/autosharkfin/end-of-an-era-d74ea936b1b6","name":"End of an Era — AutoShark Medium","type":"official","archive_url":"https://web.archive.org/web/20260724180128/https://medium.com/autosharkfin/end-of-an-era-d74ea936b1b6","credibility":2,"archive_timestamp":"2026-07-24T18:01:28+00:00"},{"url":"https://medium.com/amber-group/bsc-flash-loan-attack-the-three-copycats-e4cdbb65721e","name":"BSC Flash Loan Attack: The Three Copycats — Amber Group","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://quadrigainitiative.com/casestudy/autosharkfinanceswapminingvulnerability.php","name":"Oct 2021 AutoShark Swap Mining Vulnerability $581K — Quadriga Initiative","type":"research","archive_url":"https://web.archive.org/web/20260724212630/https://quadrigainitiative.com/casestudy/autosharkfinanceswapminingvulnerability.php","credibility":2,"archive_timestamp":"2026-07-24T21:26:30+00:00"},{"url":"https://coingape.com/autoshark-finance-is-the-latest-victim-to-the-third-flash-loan-attack-on-binance-smart-chain-in-a-week/","name":"AutoShark Finance Is the Latest Victim of the Third Flash-Loan Attack On BSC — CoinGape","type":"news_article","archive_url":"http://web.archive.org/web/20250806142430/https://coingape.com/autoshark-finance-is-the-latest-victim-to-the-third-flash-loan-attack-on-binance-smart-chain-in-a-week/","credibility":2,"archive_timestamp":"2025-08-06T14:24:30+00:00"},{"url":"https://binancechain.news/autoshark-bids-adieu-end-of-era-on-bnb-chain/2022/03/06/","name":"AutoShark Bids Adieu, End of Era on BNB Chain — Binance Chain News","type":"news_article","archive_url":"https://web.archive.org/web/20260724174549/https://expireddomains.com/domain/binancechain.news?utm_source=redi","credibility":2,"archive_timestamp":"2026-07-24T17:45:49+00:00"},{"url":"https://www.theblockbeats.com/en/flash/50591","name":"AutoShark Finance suffered a flash loan attack ~$580K — The Block Beats","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://autosharkgw.gitbook.io/autoshark/audit","name":"Audits and Safety — AutoShark GitBook","type":"official","archive_url":"https://web.archive.org/web/20260724211723/https://app.gitbook.com/o/9qX05ln69PHlrZubhpCC/sites/site_SP6F6/audit","credibility":2,"archive_timestamp":"2026-07-24T21:17:23+00:00"},{"url":"https://swapcodex.com/autoshark-finance/autoshark-news/autoshark-finance-post-exploit-plan/","name":"AutoShark Finance Post Exploit Plan — Swap Codex","type":"news_article","archive_url":"https://web.archive.org/web/20260724212945/https://www.hugedomains.com/domain_profile.cfm?d=swapcodex.com","credibility":2,"archive_timestamp":"2026-07-24T21:29:45+00:00"},{"url":"https://coinyuppie.com/hackers-attack-homologation-vulnerability-to-destroy-fork-protocol/","name":"Hackers Attack Homologation Vulnerability to Destroy Fork Protocol — CoinYuppie","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/autosharkfin/autosharks-security-posture-for-the-future-7517c103fffa","name":"AutoShark's Security Posture for the Future — AutoShark Medium","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:57.163945+00:00","updated_at":"2026-08-29T01:33:09.055+00:00"}}