PANews reported on April 1st that, according to BlockSec monitoring, an unknown contract on the BSC chain, suspected to be an LML/USDT staking protocol, was attacked, resulting in a loss of approximately $950,000. Analysis indicates the vulnerability may stem from a pricing design flaw: reward payouts are calculated based on TWAP or snapshot prices, allowing attackers to sell reward tokens at a manipulated spot price. The attackers first inflated the LML price by trading through paths containing addresses with zero recipients, then used addresses that had previously deposited tokens to call the payout function, directly obtaining the rewards during the attack.