Flash Loan Price Manipulation Drains Elephant Money's TRUNK Stablecoin

Despite having undergone a security audit, Elephant Money fell victim to a flash loan exploit that manipulated the price of its native ELEPHANT token during the minting process of TRUNK, the project's stablecoin.

Solidity Finance, which had audited the protocol, did not flag the price manipulation vulnerability that was ultimately exploited. Elephant Money's official post-mortem put the loss at $11.2 million, but PeckShield noted this figure excluded roughly 30 billion ELEPHANT tokens also lost in the attack, bringing the real total to approximately $22.2 million. In the aftermath, the project's official account posted "DO NOT SELL" in a tweet.

BlockSecTeam documented the mechanics of the exploit. In an example transaction, the attacker borrowed flash loans of 131,000 WBNB and 91 million BUSD, then swapped the 131,162.00 WBNB into 34.244e21 ELEPHANT.

The vulnerability lay in how TRUNK is minted: depositing BUSD triggers the underlying contract to first swap BUSD for WBNB, then use that WBNB to purchase ELEPHANT — a step that itself pushes up ELEPHANT's price. By minting TRUNK, the attacker both received TRUNK tokens and inflated the value of the ELEPHANT holdings acquired moments earlier.

The attacker then converted the ELEPHANT — originally bought with 131,000 WBNB — back into roughly 164,000 WBNB, and separately redeemed the minted TRUNK for about 37,000 WBNB and 67 million BUSD. Combined, this yielded roughly 200,000 WBNB and 67 million BUSD. After repaying the original flash loans of 131,000 WBNB and 91 million BUSD, the attacker walked away with an estimated $4 million profit from a single cycle.

By repeating this sequence multiple times, the attacker's total take reached more than 27,000 WBNB, valued at $11.2 million. Following the attack, the funds were routed through several accounts before being bridged to Ethereum or funneled into Tornado Cash, a flow PeckShield mapped out in an on-chain visualization.

The exploit placed Elephant Money at position #28 on rekt's leaderboard, notwithstanding the project's efforts to minimize the reported loss. In the wake of the attack, ELEPHANT's price dropped 75%, while TRUNK — nominally a stablecoin — fell 40% before partially recovering to $0.78.

The episode follows a familiar template of flash-loan-driven price manipulation. Notably, shortly before the exploit, Elephant Money's marketing account had published a now widely mocked tweet urging holders not to sell.

Credit: BlockSecTeam