Flamingo Finance Staking Exploit Mints 2.19T FLM on Neo N3
Staking contract reward flaw on Flamingo Finance allowed mint of 2.19 trillion FLM and liquidity drain; Neo Council froze the address.
Flamingo Finance, the main DeFi platform on Neo N3, suffered an exploit in its staking contract reward calculation. The attacker minted approximately 2.19 trillion FLM tokens against a prior circulating supply of roughly 570 million and used the tokens to drain the FLM/WBTC, FLM/FUSD, and FLM/bNEO liquidity pools.
Flamingo lead developer Atlazor and team lead Mr.Google stated in the project Discord that the flaw stemmed from incorrect LP token release amounts when the lending contract called the staking contract, compounded by an issue triggered on very small withdrawals. The minted FLM was sold across the pools, distorting prices to the lowest order-book levels and allowing extraction of WBTC, FUSD, and bNEO. The FUSD pool was not fully emptied and about 11,000 bNEO remained due to OrderBook contract limits.
The Neo Council voted to freeze the attacker address on Neo N3. No official public statement from Flamingo Finance had been issued at the time of reporting. Exact remaining liquidity loss, remediation timeline, and full technical root cause remain under investigation.