{"investigation":{"slug":"pancakebunny","entity_name":"PancakeBunny","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.87,"status":"published","content_type":"investigation","summary":"PancakeBunny was a Binance Smart Chain yield aggregator and optimizer built by a team known as Mound, launched in December 2020. The protocol suffered two major flash loan exploits in 2021: a May 20, 2021 attack that caused the BUNNY token to crash over 95% and wiped out approximately $200 million in market capitalization, and a July 16, 2021 attack on its Polygon fork PolyBunny that resulted in $2.4 million in losses. Both exploits stemmed from oracle price manipulation vulnerabilities in the minting reward logic, and the protocol has never recovered to its pre-exploit state.","sections":[{"content":"PancakeBunny is a decentralized finance yield aggregator built on the Binance Smart Chain (BSC), designed to auto-compound yields from PancakeSwap (CAKE) and Venus (XVS) farming positions. It was developed by a team operating under the name Mound and launched in December 2020. At its peak the protocol ranked among the largest BSC DeFi projects by total value locked (TVL), reportedly reaching fourth place on the chain. The platform charged a 30% performance fee on rewards and a 0.5% withdrawal fee for exits within 72 hours of deposit. Mound later disclosed a partnership with Binance Labs. PancakeBunny subsequently expanded to Polygon with a fork called PolyBunny, using QuickSwap as its underlying DEX.","heading":"Protocol Overview","sources":[{"url":"https://crypto-economy.com/pancakebunny-finance/","name":"crypto-economy.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/pancake-bunny-x-binance-labs-introducing-your-team-mound-288c21209375","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://pancakebunny-finance.readthedocs.io/en/main/","name":"pancakebunny-finance.readthedocs.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 20, 2021, PancakeBunny suffered a critical flash loan exploit on the Binance Smart Chain. The attacker borrowed 2.3 million WBNB recursively across seven PancakePair contracts and the ForTube Bank using nested pancakeCall() callbacks. The core vulnerability resided in how the protocol's priceCalculator.valueOfAsset() function used reserve balances from the BUNNY-BNB PancakePair as a price oracle — making it trivially manipulable via large token swaps. By first swapping flash-loaned WBNB for USDT to manipulate pool reserves, the attacker triggered the protocol's getReward() function, which minted approximately 6.9 to 7 million BUNNY tokens from nothing. An amplification factor of five in the amountBunnyToMint() function magnified the manipulation. The minted tokens were dumped on PancakeSwap to repay flash loans, with the attacker netting approximately 104,000 WBNB plus 3.8 million USDT — a profit of roughly $45 million. The BUNNY token price collapsed from approximately $145–$146 to as low as $6.17 in seconds, a decline exceeding 95%. Total market capitalization loss was reported at approximately $200 million. The attack also triggered contagion: three forked protocols — AutoShark, Merlin Labs, and PancakeHunny — were subsequently exploited using the same attack vector.","heading":"May 2021 Flash Loan Attack (BSC)","sources":[{"url":"https://medium.com/amber-group/bsc-flash-loan-attack-pancakebunny-3361b6d814fd","name":"medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2021/05/20/flash-loan-attack-causes-defi-token-bunny-to-crash-over-95","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/71585/pancakebunny-defi-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://beincrypto.com/pancakebunny-attacked-massive-200m-flash-loan-exploit/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://cmichel.io/bsc-pancake-bunny-exploit-post-mortem/","name":"cmichel.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 16, 2021, PancakeBunny's Polygon network fork PolyBunny was struck by a second flash loan attack, resulting in approximately $2.4 million in losses (1,281.7 ETH). The attacker borrowed approximately $48 million via an Aave flash loan, deposited a nominal amount (~$19,203 USD in SLP tokens) into a PolyBunny vault, and simultaneously deposited ~$47.99 million directly into SushiSwap's MiniChefV2 contract. The VaultSushiFlipToFlip contract incorrectly used the MiniChefV2 balance as collateral for minting, allowing the attacker to mint approximately 2.1 million polyBUNNY tokens. The polyBUNNY token price fell from $10 to approximately $1.78, an 82% decline. Notably, a virtually identical attack vector had been used against ApeRocketFi (a PancakeBunny fork) just two days earlier; PancakeBunny failed to implement preventive measures before the same exploit was applied to PolyBunny. The BSC version of PancakeBunny was not directly affected by this second incident.","heading":"July 2021 Flash Loan Attack (Polygon — PolyBunny)","sources":[{"url":"https://rekt.news/pancakebunny2-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://cryptoslate.com/bsc-defi-app-pancakebunny-releases-post-mortem-of-2-4-million-exploit/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://beincrypto.com/polybunny-finance-releases-2-4m-defi-attack-post-mortem-report/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://binancechain.news/pancakebunny-hit-with-another-flash-loan-exploit-this-time-on-polygon/2021/07/19/","name":"binancechain.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the May 2021 exploit, Team Mound launched a multi-pronged compensation plan. A new token, pBUNNY, was issued to all BUNNY holders at the time of the exploit and entitled them to proportional claims on a Compensation Pool. Funding sources for the Compensation Pool included the protocol's 30% performance fee stream and additional assets such as QFI tokens and any funds recovered from the attacker. The team projected that if TVL averaged $1–2 billion over the following three months, pBUNNY holders could receive up to $30 million in performance fees. Following the July 2021 PolyBunny exploit, the team distributed approximately $2.4 million in MND tokens to affected polyBUNNY holders. In a broader recovery plan, Mound tripled development capacity and announced post-exploit security partnerships with Theori, CertiK, and Hexlant for smart contract audits, as well as a bug bounty program with Immunefi. Despite these measures, the BUNNY token never recovered meaningfully — from a peak all-time high of approximately $553 in April 2021, it traded below $1 by early 2023.","heading":"Compensation and Recovery Attempts","sources":[{"url":"https://pancakebunny.medium.com/go-forward-plan-e29e58bc375f","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/pbunny-and-the-compensation-pool-how-to-use-them-and-how-they-work-c9c71fb34cad","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://beincrypto.com/pancakebunny-postmortem-details-attack-compensation-plan/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/pancakebunny-recovery-plan-63324473ceb4","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/polybunny-pbunny-mnd-compensation-cee3d5883ae6","name":"pancakebunny.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the May 2021 exploit, PancakeBunny had undergone a smart contract audit by Haechi (version 2.0), a copy of which was made publicly available via its GitHub repository. However, the audit did not identify the flash loan oracle manipulation vulnerability that was ultimately exploited. Following the two exploits, Mound engaged Theori, CertiK, and Hexlant as additional security reviewers and established an Immunefi bug bounty program with 1:1 matching through the Armour Alliance Bug Bounty Challenge. A security bulletin published by the team outlined remediation steps. The repeated exploitation of forked protocols using identical attack vectors — and PolyBunny's failure to harden against a known attack that had struck ApeRocketFi just 48 hours earlier — raised concerns about the team's incident response and inter-protocol coordination practices.","heading":"Security Posture and Audit History","sources":[{"url":"https://pancakebunny.medium.com/pancakebunny-security-bulletin-9b03c42d2512","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://github.com/PancakeBunny-finance/Bunny/blob/main/audits/%5BHAECHI%20AUDIT%5D%20PancakeBunny%20Smart%20Contract%20Audit%20Report%20ver%202.0.pdf","name":"github.com","type":"other","credibility":3},{"url":"https://medium.com/amber-group/bsc-flash-loan-attack-pancakebunny-3361b6d814fd","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The May 2021 PancakeBunny exploit triggered a wave of attacks on forked BSC protocols that shared the same vulnerable codebase. Within days of the original attack, AutoShark, Merlin Labs, and PancakeHunny — all forks of PancakeBunny — were exploited using the same or similar oracle manipulation techniques. Merlin Labs lost approximately 240 ETH (~$680,000). The cascade illustrated a systemic risk in the BSC DeFi ecosystem of the period: protocols frequently forked codebases without fully auditing or understanding inherited vulnerabilities. Amber Group's security team provided detailed post-mortem analysis of both the PancakeBunny attack and the three subsequent copycat exploits.","heading":"Contagion and Ecosystem Impact","sources":[{"url":"https://medium.com/amber-group/bsc-flash-loan-attack-pancakebunny-3361b6d814fd","name":"medium.com","type":"other","credibility":3},{"url":"https://rekt.news/merlinlabs-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://thefinancialanalyst.net/2021/07/24/bsc-flash-loan-attack-the-three-copycats/","name":"thefinancialanalyst.net","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2026, PancakeBunny operates with significantly diminished activity and TVL compared to its 2021 peak. The BUNNY token, which reached an all-time high of approximately $553 in April 2021, trades at a fraction of a dollar. CoinMarketCap and CoinGecko continue to list the token with negligible market capitalization. The project has not been formally shut down, but its community activity, protocol development, and TVL all remain at minimal levels. No regulatory actions or law enforcement proceedings have been publicly reported against the Mound team or PancakeBunny.","heading":"Current Status","sources":[{"url":"https://coinmarketcap.com/currencies/pancakebunny/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/pancake-bunny","name":"coingecko.com","type":"other","credibility":3},{"url":"https://www.bitdegree.org/cryptocurrency-prices/pancakebunny-bunny-price/price-history","name":"bitdegree.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-12","event":"PancakeBunny launches on Binance Smart Chain, developed by Team Mound.","source":"","date_original":"2020-12-01"},{"date":"2021-04-27","event":"BUNNY token reaches all-time high of approximately $553.","source":""},{"date":"2021-05-20","event":"Flash loan attack on BSC: attacker mints ~6.9M BUNNY tokens via oracle manipulation, netting ~$45M. BUNNY price crashes over 95% from ~$146 to ~$6. Market cap loss estimated at $200M.","source":""},{"date":"2021-05-25","event":"AutoShark, a PancakeBunny fork, is exploited using the same attack vector.","source":""},{"date":"2021-05-26","event":"Merlin Labs and PancakeHunny, additional PancakeBunny forks, are exploited using similar techniques.","source":""},{"date":"2021-05-27","event":"PancakeBunny publishes Go Forward Plan, announces pBUNNY compensation token and Compensation Pool.","source":""},{"date":"2021-07-14","event":"ApeRocketFi, another PancakeBunny fork on Polygon, is exploited using the same mint-manipulation vulnerability that would be used against PolyBunny two days later.","source":""},{"date":"2021-07-16","event":"PolyBunny (PancakeBunny's Polygon fork) is hit by a second flash loan attack. Attacker mints 2.1M polyBUNNY tokens via SushiSwap vault miscalculation, nets $2.4M (1,281.7 ETH). polyBUNNY price falls 82%.","source":""},{"date":"2021-07-21","event":"Team Bunny announces slowdown of new product releases to prioritize security; distributes MND tokens as compensation to PolyBunny holders.","source":""},{"date":"2022","event":"BUNNY token price at approximately $1.16, down 99.8% from April 2021 all-time high.","source":"","date_original":"2022-01-01"},{"date":"2023","event":"BUNNY token price at approximately $0.30, protocol continues with minimal TVL and activity.","source":"","date_original":"2023-01-01"}],"sources_used":[{"url":"https://crypto-economy.com/pancakebunny-finance/","name":"crypto-economy.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/pancake-bunny-x-binance-labs-introducing-your-team-mound-288c21209375","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://pancakebunny-finance.readthedocs.io/en/main/","name":"pancakebunny-finance.readthedocs.io","type":"other","credibility":3},{"url":"https://medium.com/amber-group/bsc-flash-loan-attack-pancakebunny-3361b6d814fd","name":"medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2021/05/20/flash-loan-attack-causes-defi-token-bunny-to-crash-over-95","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/71585/pancakebunny-defi-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://beincrypto.com/pancakebunny-attacked-massive-200m-flash-loan-exploit/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://cmichel.io/bsc-pancake-bunny-exploit-post-mortem/","name":"cmichel.io","type":"other","credibility":3},{"url":"https://rekt.news/pancakebunny2-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://cryptoslate.com/bsc-defi-app-pancakebunny-releases-post-mortem-of-2-4-million-exploit/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://beincrypto.com/polybunny-finance-releases-2-4m-defi-attack-post-mortem-report/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://binancechain.news/pancakebunny-hit-with-another-flash-loan-exploit-this-time-on-polygon/2021/07/19/","name":"binancechain.news","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/go-forward-plan-e29e58bc375f","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/pbunny-and-the-compensation-pool-how-to-use-them-and-how-they-work-c9c71fb34cad","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://beincrypto.com/pancakebunny-postmortem-details-attack-compensation-plan/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/pancakebunny-recovery-plan-63324473ceb4","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/polybunny-pbunny-mnd-compensation-cee3d5883ae6","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://pancakebunny.medium.com/pancakebunny-security-bulletin-9b03c42d2512","name":"pancakebunny.medium.com","type":"other","credibility":3},{"url":"https://github.com/PancakeBunny-finance/Bunny/blob/main/audits/%5BHAECHI%20AUDIT%5D%20PancakeBunny%20Smart%20Contract%20Audit%20Report%20ver%202.0.pdf","name":"github.com","type":"other","credibility":3},{"url":"https://rekt.news/merlinlabs-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://thefinancialanalyst.net/2021/07/24/bsc-flash-loan-attack-the-three-copycats/","name":"thefinancialanalyst.net","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/pancakebunny/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/pancake-bunny","name":"coingecko.com","type":"other","credibility":3},{"url":"https://www.bitdegree.org/cryptocurrency-prices/pancakebunny-bunny-price/price-history","name":"bitdegree.org","type":"other","credibility":3}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-30T18:25:37.658984+00:00","updated_at":"2026-08-29T01:35:14.502+00:00"}}