FoxMarket Flash-Loan Stale Spot-Price Bond Mint Exploit

T-2 months: Attacker EOA (0x5670d36f...) receives 1 BNB gas funding from FixedFloat, establishing operational capital ahead of the exploit. T0 (Aug 15, 2026, block 116169049): Attacker executes a single atomic transaction. FoxLpBondsPool.stake() calculates and fixes the _stakeAmount parameter from a manipulable PancakeSwap AMM spot quote before executing its own large USDT→Fox swap. That swap materially skews the pair reserves. The subsequent addLiquidity() call supplies Fox and USDT at a drastically different reserve ratio, but _stakeAmount is never recomputed from the actual deposited assets or fair LP value. Treasury.lpBonds() blindly trusts this stale, economically unsupported value, mints Fox based on it, and immediately transfers the inviter reward amount to the attacker-controlled referral address (0x3a82a2a7...). The attacker sells the newly minted Fox back into the pair within the same transaction, netting ~112,976-119,140 USDT. Aug 15 (same day): Defimon and monitoring bots flag the anomalous transaction in real time. Aug 15-17: SlowMist Hacked indexes the incident at $118,700. Aug 17, 06:43 UTC: @SlowMist_Team publishes the full technical alert with attacker and contract addresses verbatim. Aug 17-18: @AMLBotHQ traces the ~119.14K USDT to a dormant wallet (0x005806c...). An independent researcher publishes a full technical post-mortem ('A $482M Create Your Own Market Then Harvest Exploit') breaking down the flash-loan trace and the unbacked StakedFox liability. No recovery, compensation, or further response from the FoxMarket team has been publicly documented as of Aug 21.