MCN Labs — LPBonus reserve mismatch inflates LP reward claim

Sep 29, 2026 at 17:51:26 UTC the attacker EOA was funded through a Tornado Cash 0.1 BNB withdrawal. At 17:52:41 UTC it deployed the attack contract and at 17:53:01 UTC (block 124759921) ran the exploit in one transaction: it flash-borrowed 13,481,395.30 FIST from FstSwap, bought 140 MSN and added it as LP, dumped 12.2M FIST to crush the MSN reserve to 89.33 while reward accrual fired, bought MSN back to lift the reserve to 491.11, and removed liquidity. UserRemoveLp then paid 1,442,165.713011 FIST against about 940,041.61 FIST funded. After repaying the flash loan the attacker kept about 92.6k USDT. TenArmor (Sep 30, 01:38 UTC) and SlowMist (Sep 30, 03:59 UTC) flagged it. One minute after the exploit the full USDT balance was bridged to Ethereum via MetaMask Bridge (Bridgers) and converted to 34.18 ETH, which was deposited into Tornado Cash in eight transactions between 18:11 and 18:18 UTC. No project statement was found.