Date: July 13, 2026
Chain: BNB Chain
Loss: about $109,600
Class: price read from live pool reserves that a flash loan can move
At 07:38:34 UTC on July 13, 2026, one BNB Chain transaction borrowed more than 400,000 WBNB, used it to borrow ETH from at least ten lenders and pools, and sold 22,583.60 ETH into a single PancakeSwap ETH/USDT pair for just 451,300 USDT. While that pair's price sat wildly out of line, an unverified contract paid out about 76 ETH, and a moment later the swap was reversed and every loan was repaid.
TenArmor's monitoring account flagged the transaction the next day as a suspected price manipulation attack on a contract named VECAndETH, with losses of about $109,600. The pattern in the trace is the classic one for that class: a contract that sets what it pays out from a pool's live reserves, which a borrowed pile of capital can push wherever the attacker needs for the length of one transaction.
No website, documentation or team statement has surfaced for VECAndETH. The name suggests a contract handling a VEC token alongside ETH, and the contract that lost the ETH in this transaction, 0x3e50...47a1, has unverified source code, so its functions can't be read on BscScan. Its recent call history shows two function selectors over and over, 0xa694fc3a and 0x3d18b912, which match the common stake(uint256) and getReward() functions of a staking rewards contract, and by October 19, 2026 it held almost no ETH.
The attacker's address, 0x39b3...f27c, sent the transaction to itself. On the explorer, it starts with a flash loan of 408,021.59 WBNB from Moolah, a lending pool that lets money be borrowed and repaid inside one transaction. The attacker unwrapped it and supplied the BNB to Venus, receiving about 16.36 million vBNB, and then pulled ETH from at least ten lenders and pools, including 3,762.08 ETH from Aave's BNB Chain market and 9,824.47 ETH from 0xf508...92c8.
Next, the attacker sold 22,583.60 ETH into the PancakeSwap ETH/USDT pair 0x531f...ea7e and received 451,300.84 USDT, a price of roughly $20 per ETH inside that pool. With the pair in that state, 0x3e50...47a1 sent 68.50 ETH to the attacker and 7.61 ETH to a second address, 0x76b4...4299. The attacker then sold the 451,300.84 USDT back into the same pair for 22,582.33 ETH, returned the borrowed ETH to each source and unwound the WBNB loan, keeping the ETH that 0x3e50...47a1 had paid out.
An automated market maker pool holds two tokens, and its spot price is simply the ratio of the two balances it holds right now. That ratio is a fair reflection of the market when nobody is pushing on it, and it can be pushed hard by anyone willing to trade a large amount into the pool. A flash loan, a loan that must be borrowed and repaid within the same transaction, removes the need to own that capital, since the attacker only has to hold it for a few function calls.
A contract that reads the reserve ratio and acts on it inside the same transaction is trusting a number the caller can set. The usual sequence is to borrow, swap a large amount into the pool to skew its reserves, call the contract while the price is skewed so it pays out, mints or values something at the wrong rate, then swap back and repay the loan, keeping the difference. A time-weighted average price, or TWAP, resists this because it averages the pool's price across many blocks, so one transaction can't move it far. A slippage or deviation guard does a similar job by reverting when the price a contract sees is too far from a reference.
Any price a contract reads in the same transaction it acts on is only as trustworthy as the cost of moving it, and with flash loans that cost is close to zero. A shop that let customers set the exchange rate at the till, as long as they set it back before leaving, would be making the same bet. The fix is a decision about where the price comes from, made at the exact line the contract reads it.
As of October 19, 2026, no statement from the team behind VECAndETH had appeared, and TenArmor's alert remained the only public account of the incident. Because the contract is unverified, the exact function that read the pair's reserves, and whether it had any partial guard, can only be inferred from the trace.
Olympix reads a contract the way an attacker would, as states, transitions and entry points, and it takes in the context around the code to infer the rules the system depends on. In a contract like VECAndETH, the state that matters is any value derived from a price, such as an amount paid out or the worth of a position, and the entry points are every public function that reads that price and acts on it. A contract's state space looks endless, but the engine maps it and uses signals to pick which paths to attack.
Olympix's static analysis surfaces the signal in this case: a price computed from a pool's current reserves, inside a function that transfers or values assets, with no TWAP read and no bound on how far that price may move. Olympix has flagged this class before in other codebases. From that signal the engine narrows from every path, to the feasible ones, to the ones that can reach the invariant, which for this contract is that no caller should be able to change what it pays out by trading against the pool in the same transaction.
BugPoCer takes that rule as its target. Using Counterexample-Guided Invariant Refutation, it starts from the system as a whole, the pool, the contract and whoever can call both, and runs paths through the pricing function until one changes the payout. A flash-loan swap that skews the reserves, followed by a call into the function that reads them, is the path that does it. The engine can also come at the same reserve read from the other end, with BugScout running known price-manipulation strategies against it under Bounded Adversarial Verification, and symbolic execution sits underneath both.
BugPoCer hands back a counterexample: the sequence of state changes, the minimal conditions that trigger it and a generated Forge test that replays it, which here would be the July 13 attack produced in development instead of on BNB Chain. Pinning down the exact guard gap in VECAndETH needs the contract's unpublished source, but this vector sits squarely inside what the engine looks for, and Olympix runs it automatically in development, at every merge and before release.
VECAndETH's loss traces back to one decision about where a price comes from. Builders who check every line that reads a pool's reserves, and ask whether a single transaction could move that number before the contract acts on it, close off one of the most common attacks in DeFi. To see how Olympix traces each price your contracts trust back to its source and returns a runnable counterexample wherever that source can be moved, book a technical walkthrough.
Protocol: VECAndETH
Chain: BNB Chain
Date: July 13, 2026, 07:38:34 UTC (TenArmor alert at 01:26 UTC on July 14)
Loss: about $109,600 (per TenArmor)
Attacker: 0x39b3...f27c
Drained contract (unverified): 0x3e50...47a1
Manipulated pair (PancakeSwap ETH/USDT): 0x531f...ea7e
Flash loan source (Moolah): 0x8f73...5d8c
Exploit tx: 0xe1f1...eb72
Block: 109708922
TenArmor: VECAndETH alert on X
ChainCatcher: VECAndETH incident report
Phemex News: VECAndETH contract on BSC chain hit by suspected price manipulation