SlowMist: Little Boy Plus hacked, approximately $370,000 in funds stolen

Foresight News reports, according to SlowMist's monitoring, the DeFi mining protocol Little Boy Plus on BSC has been hacked, resulting in a loss of about 370,000 US dollars (approximately 610.555 BNB). The reason was that the `LBPHashrate._update()` function (located at `0x5e3c...85fe`) was triggered by a zero-value `transferFrom` call, bypassing OpenZeppelin's authorization check. This allowed the attacker to call `LBPHashrate.transferFrom(pair, DEAD, 0)` without pair authorization, thereby triggering `_harvest(pair)`. This function directly mints LBP tokens to the PancakePair address via `LBP.mintReward(pair, reward)`. The minted LBP increased the pair's balance but did not increase its reserves, enabling the attacker to drain USDT through `PancakePair.swap()`.