LOOPSDAO LpdFi Flash Loan Price Manipulation

T0 (August 2, 2026, block 113613924, BscScan transaction verified in full): Attacker 0x5d289266d85EF671561bA3F253FB79327C193f33 executes a flash loan of 730,607.75 USDC sourced from Uniswap V4 Pool Manager. The loan is used to manipulate the spot price of the thin PancakeSwap V2 LPD/USDC liquidity pool, which had no time-weighted average price (TWAP) mechanism or deviation guard protecting it. The attacker opens a massively inflated interest-bearing position within the LpdFi protocol using minimal actual LPD collateral, then claims accrued interest at precisely the daily settlement boundary. This action triggers the LpdFi protocol contract (0xcE6A6e4413d85a136bbac8aae6fb46eaa77f295e) to burn 1,678,049.36 of its own Cake-LP tokens and disburse 4,059,427.5 LPD tokens plus 700,535.14 USDC to the attacker's executor contract (0x7f5AD0A998Dcb3f5006F0D152BEBC055979EF711). The executor forwards approximately $693,496 onward to the attacker EOA, with roughly $7,005 skimmed off to a separate fee-collection address along the way. The attacker repays the original 730,607.75 USDC Uniswap V4 flash loan and swaps remaining proceeds back into WBNB via PancakeSwap Router v2. Final net proceeds retained by the attacker: $689,496.33. T+approximately 24 hours (August 3, 2026, 06:00:52 UTC): Security research group ExVul, via the Defimon Alerts monitoring account, publishes the first detailed public technical breakdown of the exploit, including on-chain addresses. The same day, Chainalysis (citing detection by Hexagate) independently confirms the incident, describing a roughly $44 million flash loan that inflated the LPD token's spot price by a factor of 71x before the attacker's claim. SlowMist Hacked and DeFiLlama log the incident at $690,000 and $696,000 respectively (both close to, but not identical to, the on-chain-verified net figure of $689,496.33). As of the close of the reporting window, no official post-mortem, patch announcement, or user compensation plan has been published by the LOOPSDAO/LpdFi team.