Deep analysis of the flaw in BetterBank reward logic

From 26 to 27 August 2025, BetterBank, a DeFi protocol operating on the PulseChain network, suffered a sophisticated exploit centred on liquidity manipulation and reward minting, initially draining around $5 million in assets. The attack culminated in a partial recovery, with the attacker returning about $2.7 million (550 million DAI), leaving a net loss of roughly $1.4 million, according to the disclosed figures.

The root cause lay in a design flaw in the swapExactTokensForFavorAndTrackBonus function that minted ESTEEM rewards whenever a swap produced FAVOR, without validating the source liquidity pool, a vulnerability that a security audit by Zokyo had flagged but reportedly downgraded in severity. The attackers created fake liquidity and manipulated unverified pairs, exploiting a tax logic that limited fees to whitelisted pairs, and drained real reserves of 891 million DAI, 9.05 billion PLSX and 7.40 billion WPLS.

On-chain traces show the attacker bridged roughly $922,000 in ETH to the Ethereum mainnet and subsequently used a crypto mixer to obscure funds.