A Rounding Bug Costs Midas Capital $600K on BSC — Its Second Hit This Year

Midas Capital has been exploited for a second time in 2023, this time for roughly $600,000, after an attacker targeted one of the lending protocol's pools on BNB Smart Chain over the weekend.

The team acknowledged the incident by saying it had "pre-emptively paused all pools." It's the protocol's second appearance on the rekt.news leaderboard this year alone.

Following Midas Capital's first exploit in January, this outlet noted that the loss stemmed from an already-known issue with a straightforward fix available. The same holds true here: this exploit traces back to a vulnerability that had already surfaced elsewhere in April, when Hundred Finance — itself on its second appearance on the leaderboard — lost $7.4 million on Optimism to the same type of bug. Hundred's very first incident had likewise prompted a warning that when one forked codebase falls victim to a bug, every other project built on the same fork needs to check its own exposure.

Credit for identifying the exploit goes to Peckshield, Ancilia, and BlockSec.

The root cause was a rounding error in the protocol's redeem counter, which corrupted its interest rate calculations — the same underlying flaw responsible for April's Hundred Finance incident.

Notably, RSK-based lending protocol Tropykus was hit by the identical exploit method on the preceding Wednesday, losing $150,000. Researcher Alexand39172242 flagged that the address behind the Tropykus attack — which the Tropykus team later contacted — had also sent funds to the address used in the Midas attack.

Midas attacker's address: 0x4b92cc3452ef1e37528470495b86d3f976470734

The attacker has since moved a portion of the stolen funds into Tornado Cash, and bridged part of it over to Ethereum.

DeFi's composability cuts both ways: the same forked code that accelerates innovation and integration across protocols also means a single vulnerability can spread quickly across an entire ecosystem of dependent projects — sometimes reaching teams that never realized they'd inherited the flaw in the first place. Tracking these incidents as they emerge remains essential for anyone responsible for securing funds in such an interconnected space, and the rekt.news leaderboard exists precisely for that purpose.